Out-of-Bounds Vulnerability in OpenSSL CMS with Password-Based Encryption

CVE-2025-9230

What is CVE-2025-9230?

A significant vulnerability has been identified in OpenSSL's implementation of password-based encryption within CMS (Cryptographic Message Syntax). This issue allows an application to initiate an out-of-bounds read and write due to faulty decryption processes. Exploiting this vulnerability can lead to application crashes and potential memory corruption, posing risks such as Denial of Service or execution of arbitrary code by attackers. While the potential consequences are severe, instances of successful exploitation are deemed low owing to the uncommon usage of password-based encryption in CMS messages. Importantly, the FIPS modules in various OpenSSL versions remain unaffected.

References