CVE-2025-15467 OpenSSL CMS AuthEnvelopedData AEAD IV stack overflow
BLUF
A high-severity (potentially critical) stack-based buffer overflow in OpenSSL (versions 3.0-3.6) that allows an unauthenticated attacker to cause a Denial of Service (DoS) or potentially achieve Remote Code Execution (RCE) by sending a specially crafted CMS message with an oversized Initialization Vector (IV).
Executive Cost Summary
This cost analysis was developed by the CyberDax team using expert judgment and assisted analytical tools to support clarity and consistency.
For organizations affected by CVE-2025-15467 exploitation or emergency mitigation of vulnerable OpenSSL deployments, the primary financial exposure is driven by incident response labor, service disruption, and accelerated remediation across widely embedded systems.
· Low-end total cost: $250K – $600K
o (limited exposure, rapid patching, no confirmed exploitation)
· Typical expected range: $900K – $2.4M
o (internet-facing services impacted, short outages, broad patch scope)
· Upper-bound realistic scenarios: $4.0M – $8.5M
o (exploitation with service crashes or RCE, extended recovery and scrutiny)
Key Cost Drivers
· Number of externally exposed services parsing CMS / PKCS#7 content
· Emergency patching and validation across embedded OpenSSL dependencies
· Duration of customer-facing or internal service interruption
· Depth of forensic investigation required to rule out RCE
· Regulatory notification thresholds triggered by service impact or data risk
Potential Affected Sectors
· Any sector utilizing software, applications, or appliances that parse untrusted CMS/PKCS#7 content
o This includes
§ Cloud infrastructure
§ Web servers
§ VPNs
§ Email servers
Potential Impacted Countries
· Global
Date of First Reported Activity
· January 27, 2026
Date of Last Reported Activity Update
· January 28–29, 2026
Tools Used in Campaign
· Custom-crafted S/MIME messages
· Proof-of-Concept (PoC) code exploiting CMS_Decrypt API.
TTPs
Initial Access
· T1190 Exploit Public-Facing Application
o Attackers can exploit this vulnerability remotely by sending a maliciously crafted CMS or PKCS#7 message to any service using OpenSSL to parse such content (e.g., S/MIME or Kerberos with the PKINIT plugin).
· T1566 Phishing
o If the vulnerable OpenSSL library is used in client-side applications (like email clients), an attacker can deliver a crafted S/MIME message via email to trigger the overflow upon opening or processing.
Execution
· T1203 Exploitation for Client Execution
o The vulnerability allows for an out-of-bounds write on the stack before authentication occurs. This can be leveraged to gain control of the execution flow.
· T1106 Native API
o Successfull exploitation may involve calling native APIs or executing shellcode directly in the context of the vulnerable process.
Persistence & Privilege Escalation
· T1068 Exploitation for Privilege Escalation
o If the service parsing the untrusted CMS message is running with elevated privileges (such as a system daemon), successful remote code execution results in immediate privilege escalation.
Impact
· T1499.004 Endpoint Denial of Service: Application or System Exploitation: The most immediate impact of an oversized IV is a stack corruption that typically leads to an application crash.
IOCs
Host and Application Indicators
· Process Crashes
o Exploitation attempts often result in immediate application crashes (Denial of Service) due to the out-of-bounds write on the stack.
· API Misuse logs
o Monitor for crashes or errors originating from the CMS_decrypt API or the openssl cms command-line tool.
· Stack Canary Violations
o On systems with modern toolchain mitigations (like those in Red Hat Enterprise Linux), successful attempts may trigger "stack smashing detected" logs instead of remote code execution.
CVSS Vectors 3.1
· (9.8) /AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Nessus ID
· 296765
· 296766
· 296768
· 296770
· 296783
· 296784
· 296910
· 297022
· 297044
· 297055
· 297061
· 297064
· 297075
· 297079
· 297081
· 297086
· 297089
· 297105
· 297106
· 297157
· 297168
· 297209
Is CVE-2025-15467 on the KEV list?
· Not at this time
Mitigation
· Disable processing of untrusted CMS or PKCS#7 content, specifically AuthEnvelopedData using AES-GCM.
Patch Release Date
· January 27, 2026
URL Link to Patch Information
• hxxps://openssl-library.org/news/vulnerabilities/#CVE-2025-15467
Affected Software Versions
The following versions are vulnerable and should be updated to their respective patched releases:
· OpenSSL 3.6.0: Update to 3.6.1
· OpenSSL 3.5.0: Update to 3.5.5
· OpenSSL 3.4.0–3.4.3: Update to 3.4.4
· OpenSSL 3.3.0–3.3.5: Update to 3.3.6
· OpenSSL 3.0.0–3.0.18: Update to 3.0.19
Note
· OpenSSL 1.1.1 and 1.0.2 are not affected by this vulnerability.
Malware Names
· No malware has been associated with CVE-2025-15467 at this time.
Malware Family
· No specific malware family name
sha256
· No malware has been associated with CVE-2025-15467 at this time.
Known Decoding Key
· No malware has been associated with CVE-2025-15467 at this time.
Verdict
· High Risk / Critical
Primary Objectives
· Initial Access
· Potential RCE
· Denial of Service
APT groups
· There have been no APT groups affiliated with CVE-2025-15467 at this time.
Suspected criminal organizations
· No specific criminal organizations have been identified at this time.
Behavior Analysis
· The vulnerability triggers a stack-based out-of-bounds write before authentication
· Allows attackers to overflow a fixed-size buffer by sending a malicious IV
· Leads to a crash or code execution
Suggested Rules / Potential Hunts
As a reminder, these are indicator rules. They are likely to be noisy.
For best results consider creating a data model and reviewing the traffic as a report.
Suricata
· Target AuthEnvelopedData structures (OID 1.2.840.113549.1.9.16.1.23) where the AES-GCM or similar AEAD IV parameter exceeds the standard 12–16 bytes.
o Note: Refine the pcre to match specific ASN.1 tags for OCTET STRINGs containing the IV that exceed EVP_MAX_IV_LENGTH (usually 16 bytes).
alert tcp any any -> any any (msg:"ET HUNT OpenSSL CMS AuthEnvelopedData Potential IV Overflow (CVE-2025-15467)";
content:"|06 09 2a 86 48 86 f7 0d 01 09 10 01 17|"; fast_pattern;
pcre:"/(\x04[\x81-\xff].{16,})/";
reference:cve,2025-15467; classtype:attempted-admin; sid:202515467; rev:1;)
SentinelOne
· Monitor for application crashes (SigAbort or SigSegv) in processes handling untrusted CMS/PKCS#7.
EventType = "Process Exit" AND ExitCode IN (-11, -6)
AND (ProcessName IN ("openssl", "slapd", "krb5kdc") OR Commandline CONTAINS "cms")
· Alert on unexpected openssl CLI usage involving untrusted input file paths or large parameter sets.
Process.CommandLine Matches ".*openssl.*cms.*-decrypt.*"
AND Process.CommandLine Matches ".*-inform.*"
Splunk
· Correlate application errors with network traffic metadata.
o Crash Correlation:
splunk
index=linux_logs (sourcetype=syslog OR sourcetype=messages)
"segfault" "libc.so" "openssl"
| stats count by host, process_name, reason
Delivery Methods
· Malicious S/MIME messages
o Specially crafted encrypted email.
References
NVD
hxxps://nvd.nist.gov/vuln/detail/CVE-2025-15467
Tenable Plugin ID
hxxps://www.tenable.com/cve/CVE-2025-15467/plugins
OpenSSL-Library
· hxxps://openssl-library.org/news/vulnerabilities/#CVE-2025-15467
