Out-of-Bounds Vulnerability in OpenSSL CMS with Password-Based Encryption
CVE-2025-9230

7.5HIGH

Key Information:

Vendor: OpenSSL
Status: OpenSSL
Vendor: CVE Published:; 30 September 2025

What is CVE-2025-9230?

CVE-2025-9230 is an out-of-bounds vulnerability identified in OpenSSL's implementation of Cryptographic Message Syntax (CMS) that utilizes password-based encryption. OpenSSL is a widely used library that provides a robust framework for implementing cryptographic functions within software applications. This vulnerability arises when an application attempts to decrypt CMS messages that have been encrypted using this kind of password-based scheme. The flaw can lead to out-of-bounds read and write operations, which may significantly disrupt the typical functioning of the application.

In technical terms, the out-of-bounds read could result in a crash, effectively causing a Denial of Service (DoS). Moreover, the out-of-bounds write operation poses a risk of memory corruption, which could lead to unintended behavior, including a possible Denial of Service or the execution of arbitrary code supplied by an attacker. Although the potential consequences of exploitation are severe, the actual implementation of password-based encryption in CMS messages is rare, which lowers the likelihood of an attacker successfully exploiting this vulnerability. As a result, the severity of CVE-2025-9230 has been assessed as moderate according to OpenSSL’s security policies.

Potential impact of CVE-2025-9230

Denial of Service: The out-of-bounds read could cause a crash in applications that handle CMS messages, leading to service interruptions and potentially affecting business operations reliant on these applications.
Memory Corruption: The out-of-bounds write may corrupt memory, possibly allowing an attacker to manipulate program execution, which could result in unexpected application behavior or crashes.
Execution of Arbitrary Code: In severe cases, the memory corruption caused by the out-of-bounds write could allow an attacker to execute code of their choice within the context of the application, leading to unauthorized access and control over the system.