CVE-2025-15467: 
MySQL vulnerability analysis and mitigation

CVE-2025-15467 is a stack-based buffer overflow vulnerability in OpenSSL's CMS (Cryptographic Message Syntax) parsing code affecting AEAD cipher modes such as AES-GCM. When parsing CMS AuthEnvelopedData or EnvelopedData structures, the Initialization Vector (IV) encoded in ASN.1 parameters is copied into a fixed-size stack buffer without verifying that its length does not exceed EVP_MAX_IV_LENGTH, enabling a stack-based out-of-bounds write. The vulnerability was disclosed on January 27, 2026, and affects OpenSSL versions 3.0.x (before 3.0.19), 3.3.x (before 3.3.6), 3.4.x (before 3.4.4), 3.5.x (before 3.5.5), and 3.6.x (before 3.6.1); OpenSSL 1.1.1 and 1.0.2 are not affected. It carries a CVSS v3.1 base score of 8.8 (High) (OpenSSL Advisory, Red Hat CVE).

The root cause is classified as CWE-120 (Buffer Copy without Checking Size of Input) and CWE-787 (Out-of-bounds Write). In the vulnerable code path within crypto/evp/evp_lib.c, the function evp_cipher_get_asn1_aead_params() called ossl_asn1_type_get_octetstring_int() twice — first to determine the IV length, then to copy it — without validating that the returned length was within the bounds of the fixed-size stack buffer before the copy. The fix, applied across all affected branches, consolidates the two calls into one and adds an explicit check if (i <= 0 || i > EVP_MAX_IV_LENGTH) before proceeding (OpenSSL Commit). Critically, the overflow occurs before any authentication or tag verification, meaning no valid key material is required to trigger it — making it exploitable by unauthenticated attackers who can deliver a crafted CMS message to a vulnerable application (OpenSSL Advisory). The attack vector is network-based and requires user interaction (e.g., a user or service parsing a malicious S/MIME message).

Successful exploitation can cause a crash (Denial of Service) or potentially enable remote code execution, depending on platform and toolchain mitigations such as stack canaries, ASLR, and NX bits. Applications and services that parse untrusted CMS or PKCS#7 content using AEAD ciphers — including S/MIME gateways, email clients, and any software processing AuthEnvelopedData with AES-GCM — are at risk. The vulnerability has high confidentiality, integrity, and availability impact, and if RCE is achieved, it could serve as an initial access vector enabling lateral movement within an organization's infrastructure (OpenSSL Advisory, Feedly).

Multiple proof-of-concept (PoC) repositories have been published on GitHub, including those by MAXI8594, balgan, guiimoraes, mr-r3b00t, and materaj2, with exploitation activity reported by world-today-news.com (PoC GitHub, PoC GitHub). The vulnerability was notably discovered as part of a batch of 12 OpenSSL flaws identified by AI-assisted security research from AISLE, which attracted significant media attention (GlobeNewswire). The EPSS score is approximately 0.66%, indicating a relatively low but non-negligible probability of exploitation in the wild. As of the available data, CVE-2025-15467 has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, and no confirmed threat actor attribution has been reported (Feedly).

1. Reconnaissance: Identify applications or services that parse untrusted CMS/PKCS#7 content using AEAD ciphers (e.g., S/MIME email gateways, mail clients, or custom applications using OpenSSL 3.0–3.6 for decryption). Tools like Shodan or Censys can help identify internet-facing services.
2. Craft malicious CMS message: Construct a CMS AuthEnvelopedData or EnvelopedData ASN.1 structure that specifies an AEAD cipher (e.g., AES-256-GCM) and encodes an oversized IV field in the ASN.1 parameters — one whose length exceeds EVP_MAX_IV_LENGTH (16 bytes for AES-GCM).
3. Deliver the payload: Send the crafted CMS message to the target application. For S/MIME targets, this could be an email with a malicious encrypted attachment. For API-based targets, submit the crafted PKCS#7 blob via the relevant endpoint.
4. Trigger the overflow: When the vulnerable OpenSSL code in evp_cipher_get_asn1_aead_params() processes the message, it copies the oversized IV into the fixed-size stack buffer without bounds checking, causing a stack-based out-of-bounds write before any authentication occurs.
5. Achieve impact: Depending on platform mitigations, the overflow may crash the process (DoS) or, if stack layout and mitigations permit, overwrite return addresses or function pointers to redirect execution and achieve remote code execution (OpenSSL Advisory, OpenSSL Commit).

• Network: Unexpected or malformed CMS/PKCS#7 messages delivered over SMTP (S/MIME), HTTPS, or other protocols to services that process encrypted content; anomalous inbound traffic containing oversized ASN.1 IV fields in CMS structures.
• Logs: Application crash logs or core dumps from processes using OpenSSL (e.g., mail servers, web servers, custom applications); segmentation fault signals (SIGSEGV) or stack smashing errors in OpenSSL-linked processes; repeated parsing errors for CMS/PKCS#7 content in application logs.
• Process: Unexpected termination or restart of services that handle S/MIME or CMS content (e.g., postfix, dovecot, nginx, custom daemons); unusual child processes spawned from mail or web server processes following receipt of crafted messages.
• File System: Core dump files (core.*) in application working directories following crashes; unexpected new files written by the service account if RCE is achieved.

OpenSSL has released patched versions addressing this vulnerability: 3.0.19, 3.3.6, 3.4.4, 3.5.5, and 3.6.1. Upgrading to the appropriate fixed version is the primary recommended remediation (OpenSSL Advisory). As a workaround where immediate patching is not possible, restrict or disable parsing of untrusted CMS/PKCS#7 messages that use AEAD ciphers, and implement network-level controls to limit exposure to untrusted CMS content. Downstream vendors including IBM (API Connect, InfoSphere Information Server, Cloud Pak for AIOps, Netezza Appliance, Instana Observability, watsonx Orchestrate), Oracle, Red Hat, SUSE, Ubuntu, Debian, FreeBSD, Alpine Linux, and others have released their own patches — consult the relevant vendor advisories for product-specific guidance (Red Hat CVE, IBM Advisory). Note that OpenSSL FIPS modules in affected versions are not impacted, as the CMS implementation is outside the FIPS module boundary.

The vulnerability attracted significant attention due to its discovery as part of a batch of 12 OpenSSL flaws found by AISLE using AI-driven security research, with the company claiming a 12-for-12 detection rate (AISLE Blog). Security journalist Bruce Schneier covered the AI-assisted discovery on his blog, and the story was widely picked up by outlets including SecurityWeek, The Hacker News, Tom's Hardware, Heise, and VentureBeat (Schneier Blog, SecurityWeek). Datadog Security Labs published a detailed technical analysis of the January 2026 OpenSSL update covering this and related buffer overflow issues (Datadog Security Labs). Community discussion on Hacker News and Reddit highlighted concerns about the pre-authentication nature of the overflow and the broad ecosystem impact given OpenSSL's ubiquity. Orca Security also published a dedicated blog post characterizing the vulnerability as a pre-auth RCE risk (Orca Security).