CVE-2025-9230: 
OpenSSL vulnerability analysis and mitigation

CVE-2025-9230 is a vulnerability in OpenSSL's CMS message decryption functionality discovered on September 30, 2025. The vulnerability affects OpenSSL versions 3.5, 3.4, 3.3, 3.2, 3.0, 1.1.1, and 1.0.2, specifically in applications attempting to decrypt CMS messages encrypted using password-based encryption. This security flaw was reported by Stanislav Fort from Aisle Research and has been assigned a CVSS 3.1 base score of 7.5 (High) (NVD, OpenSSL Advisory).

The vulnerability stems from an incorrect check of unwrapped key size in the kekunwrapkey() function, where the check is off by 8 bytes. This implementation flaw can trigger both an out-of-bounds read of up to 8 bytes and an out-of-bounds write of up to 4 bytes when processing password-based encrypted CMS messages. The issue has been identified with CWE-125 (Out-of-bounds Read) and CWE-787 (Out-of-bounds Write) classifications. The vulnerability specifically affects the CMS implementation outside the OpenSSL FIPS module boundary (OpenSSL Advisory, OpenSSL Commit).

The vulnerability can lead to multiple severe consequences. The out-of-bounds read may trigger a crash resulting in a Denial of Service (DoS) for affected applications. More critically, the out-of-bounds write can cause memory corruption, potentially leading to either Denial of Service or execution of attacker-supplied code. However, the probability of successful exploitation is considered low, particularly since password-based (PWRI) encryption support in CMS messages is rarely used (OpenSSL Advisory).

OpenSSL has released patched versions to address this vulnerability. Users are advised to upgrade to the following versions based on their current installation: OpenSSL 3.5 users should upgrade to 3.5.4, 3.4 users to 3.4.3, 3.3 users to 3.3.5, 3.2 users to 3.2.6, 3.0 users to 3.0.18, 1.1.1 users to 1.1.1zd (premium support customers only), and 1.0.2 users to 1.0.2zm (premium support customers only). Ubuntu has also released security updates across multiple versions to address this vulnerability (OpenSSL Advisory, Ubuntu Security).