UpHeron
All vulnerabilities

Servers and applications

CVE-2025-15467

Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote code execution. When parsing CMS (Auth)EnvelopedData structures that use AEAD ciphers such as AES-GCM, the IV (Initialization Vector)…

Severity
High 8.8
Published
27 Jan 2026
Last changed
15 Oct 2026
Added to UpHeron
21 Oct 2026
Fixed in
3.0.19, 3.3.6, 3.4.4, 3.5.5, 3.6.1
Sources
NVD

Affected software

SoftwareAffected versions
OpenSSLServers and applications · cpe:a:openssl:openssl
  • From 3.0.0 before 3.0.19
  • From 3.1.0 before 3.3.6
  • From 3.4.0 before 3.4.4
  • From 3.5.0 before 3.5.5
  • From 3.6.0 before 3.6.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-15467
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-15467