OpenSSL 3.x CMS AuthEnvelopedData AEAD IV stack overflow (v3.6+)
CVE-2025-15467 Published on January 27, 2026

Stack buffer overflow in CMS (Auth)EnvelopedData parsing
Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote code execution. When parsing CMS (Auth)EnvelopedData structures that use AEAD ciphers such as AES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is copied into a fixed-size stack buffer without verifying that its length fits the destination. An attacker can supply a crafted CMS message with an oversized IV, causing a stack-based out-of-bounds write before any authentication or tag verification occurs. Applications and services that parse untrusted CMS or PKCS#7 content using AEAD ciphers (e.g., S/MIME (Auth)EnvelopedData with AES-GCM) are vulnerable. Because the overflow occurs prior to authentication, no valid key material is required to trigger it. While exploitability to remote code execution depends on platform and toolchain mitigations, the stack-based write primitive represents a severe risk. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue. OpenSSL 1.1.1 and 1.0.2 are not affected by this issue.

Github Repository Vendor Advisory NVD

Vulnerability Analysis

CVE-2025-15467 can be exploited with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. An automatable proof of concept (POC) exploit exists. The potential impact of an exploit of this vulnerability is considered to be very high.

Attack Vector:

NETWORK

Attack Complexity:

LOW

Privileges Required:

NONE

User Interaction:

REQUIRED

Scope:

UNCHANGED

Confidentiality Impact:

HIGH

Integrity Impact:

HIGH

Availability Impact:

HIGH

Weakness Type

What is a Memory Corruption Vulnerability?

The software writes data past the end, or before the beginning, of the intended buffer. Typically, this can result in corruption of data, a crash, or code execution. The software may modify an index or perform pointer arithmetic that references a memory location that is outside of the boundaries of the buffer. A subsequent write operation then produces undefined or unexpected results.

CVE-2025-15467 has been classified to as a Memory Corruption vulnerability or weakness.

Products Associated with CVE-2025-15467

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2025-15467 are published in these products:

OpenSSL

Canonical Ubuntu Linux

Red Hat Http Server

Oracle

Siemens Simatic Easie Core Package

Siemens Simatic Rtls Locating Manager

Siemens Simatic Step 7

Siemens Simatic Wincc

Siemens Sinec Ins

Siemens Sinec Nms

Siemens Sinec Security Monitor

Affected Versions

OpenSSL:

Version 3.6.0 and below 3.6.1 is affected.
Version 3.5.0 and below 3.5.5 is affected.
Version 3.4.0 and below 3.4.4 is affected.
Version 3.3.0 and below 3.3.6 is affected.
Version 3.0.0 and below 3.0.19 is affected.

Siemens AI Lightweight Inference Server:

Before * is affected.

Siemens Connector for Azure:

Before V1.8.0 is affected.

Siemens Databus:

Before V3.3.2 is affected.

Siemens HiMed Cockpit:

Before * is affected.

Siemens RUGGEDCOM RM1224 LTE(4G) EU:

Before * is affected.

Siemens RUGGEDCOM RM1224 LTE(4G) NAM:

Before * is affected.

Siemens SCALANCE LPE9403:

Before * is affected.

Siemens SCALANCE LPE9413:

Before * is affected.

Siemens SCALANCE LPE9433:

Before * is affected.

Siemens SCALANCE M804PB:

Before * is affected.

Siemens SCALANCE M812-1 ADSL-Router family:

Before * is affected.

Siemens SCALANCE M816-1 ADSL-Router family:

Before * is affected.

Siemens SCALANCE M826-2 SHDSL-Router:

Before * is affected.

Siemens SCALANCE M874-2:

Before * is affected.

Siemens SCALANCE M874-3:

Before * is affected.

Siemens SCALANCE M874-3 3G-Router (CN):

Before * is affected.

Siemens SCALANCE M876-3:

Before * is affected.

Siemens SCALANCE M876-3 (ROK):

Before * is affected.

Siemens SCALANCE M876-4:

Before * is affected.

Siemens SCALANCE M876-4 (EU):

Before * is affected.

Siemens SCALANCE M876-4 (NAM):

Before * is affected.

Siemens SCALANCE MUB852-1 (A1):

Before * is affected.

Siemens SCALANCE MUB852-1 (B1):

Before * is affected.

Siemens SCALANCE MUM853-1 (A1):

Before * is affected.

Siemens SCALANCE MUM853-1 (B1):

Before * is affected.

Siemens SCALANCE MUM853-1 (EU):

Before * is affected.

Siemens SCALANCE MUM856-1 (A1):

Before * is affected.

Siemens SCALANCE MUM856-1 (B1):

Before * is affected.

Siemens SCALANCE MUM856-1 (CN):

Before * is affected.

Siemens SCALANCE MUM856-1 (EU):

Before * is affected.

Siemens SCALANCE MUM856-1 (RoW):

Before * is affected.

Siemens SCALANCE S615 EEC LAN-Router:

Before * is affected.

Siemens SCALANCE S615 LAN-Router:

Before * is affected.

Siemens SCALANCE SC622-2C:

Before * is affected.

Siemens SCALANCE SC626-2C:

Before * is affected.

Siemens SCALANCE SC632-2C:

Before * is affected.

Siemens SCALANCE SC636-2C:

Before * is affected.

Siemens SCALANCE SC642-2C:

Before * is affected.

Siemens SCALANCE SC646-2C:

Before * is affected.

Siemens SCALANCE WAB762-1:

Before * is affected.

Siemens SCALANCE WAM763-1:

Before * is affected.

Siemens SCALANCE WAM763-1 (ME):

Before * is affected.

Siemens SCALANCE WAM763-1 (US):

Before * is affected.

Siemens SCALANCE WAM766-1:

Before * is affected.

Siemens SCALANCE WAM766-1 (ME):

Before * is affected.

Siemens SCALANCE WAM766-1 (US):

Before * is affected.

Siemens SCALANCE WAM766-1 EEC:

Before * is affected.

Siemens SCALANCE WAM766-1 EEC (ME):

Before * is affected.

Siemens SCALANCE WAM766-1 EEC (US):

Before * is affected.

Siemens SCALANCE WUB762-1:

Before * is affected.

Siemens SCALANCE WUB762-1 iFeatures:

Before * is affected.

Siemens SCALANCE WUM763-1:

Before * is affected.

Siemens SCALANCE WUM763-1:

Before * is affected.

Siemens SCALANCE WUM763-1 (US):

Before * is affected.

Siemens SCALANCE WUM763-1 (US):

Before * is affected.

Siemens SCALANCE WUM766-1:

Before * is affected.

Siemens SCALANCE WUM766-1 (ME):

Before * is affected.

Siemens SCALANCE WUM766-1 (USA):

Before * is affected.

Siemens SCALANCE X200-4P IRT:

Before * is affected.

Siemens SCALANCE X200-4P IRT:

Before * is affected.

Siemens SCALANCE X201-3P IRT:

Before * is affected.

Siemens SCALANCE X201-3P IRT:

Before * is affected.

Siemens SCALANCE X201-3P IRT PRO:

Before * is affected.

Siemens SCALANCE X201-3P IRT PRO:

Before * is affected.

Siemens SCALANCE X202-2IRT:

Before * is affected.

Siemens SCALANCE X202-2IRT:

Before * is affected.

Siemens SCALANCE X202-2P IRT:

Before * is affected.

Siemens SCALANCE X202-2P IRT:

Before * is affected.

Siemens SCALANCE X202-2P IRT PRO:

Before * is affected.

Siemens SCALANCE X202-2P IRT PRO:

Before * is affected.

Siemens SCALANCE X204-2:

Before * is affected.

Siemens SCALANCE X204-2FM:

Before * is affected.

Siemens SCALANCE X204-2LD:

Before * is affected.

Siemens SCALANCE X204-2LD TS:

Before * is affected.

Siemens SCALANCE X204-2TS:

Before * is affected.

Siemens SCALANCE X204IRT:

Before * is affected.

Siemens SCALANCE X204IRT:

Before * is affected.

Siemens SCALANCE X204IRT PRO:

Before * is affected.

Siemens SCALANCE X204IRT PRO:

Before * is affected.

Siemens SCALANCE X204RNA (HSR):

Before * is affected.

Siemens SCALANCE X204RNA (PRP):

Before * is affected.

Siemens SCALANCE X204RNA EEC (HSR):

Before * is affected.

Siemens SCALANCE X204RNA EEC (PRP):

Before * is affected.

Siemens SCALANCE X204RNA EEC (PRP/HSR):

Before * is affected.

Siemens SCALANCE X206-1:

Before * is affected.

Siemens SCALANCE X206-1LD:

Before * is affected.

Siemens SCALANCE X208:

Before * is affected.

Siemens SCALANCE X208PRO:

Before * is affected.

Siemens SCALANCE X212-2:

Before * is affected.

Siemens SCALANCE X212-2LD:

Before * is affected.

Siemens SCALANCE X216:

Before * is affected.

Siemens SCALANCE X224:

Before * is affected.

Siemens SCALANCE X302-7 EEC (230V, coated):

Before * is affected.

Siemens SCALANCE X302-7 EEC (230V):

Before * is affected.

Siemens SCALANCE X302-7 EEC (24V, coated):

Before * is affected.

Siemens SCALANCE X302-7 EEC (24V):

Before * is affected.

Siemens SCALANCE X302-7 EEC (2x 230V, coated):

Before * is affected.

Siemens SCALANCE X302-7 EEC (2x 230V):

Before * is affected.

Siemens SCALANCE X302-7 EEC (2x 24V, coated):

Before * is affected.

Siemens SCALANCE X302-7 EEC (2x 24V):

Before * is affected.

Siemens SCALANCE X304-2FE:

Before * is affected.

Siemens SCALANCE X306-1LD FE:

Before * is affected.

Siemens SCALANCE X307-2 EEC (230V, coated):

Before * is affected.

Siemens SCALANCE X307-2 EEC (230V):

Before * is affected.

Siemens SCALANCE X307-2 EEC (24V, coated):

Before * is affected.

Siemens SCALANCE X307-2 EEC (24V):

Before * is affected.

Siemens SCALANCE X307-2 EEC (2x 230V, coated):

Before * is affected.

Siemens SCALANCE X307-2 EEC (2x 230V):

Before * is affected.

Siemens SCALANCE X307-2 EEC (2x 24V, coated):

Before * is affected.

Siemens SCALANCE X307-2 EEC (2x 24V):

Before * is affected.

Siemens SCALANCE X307-3:

Before * is affected.

Siemens SCALANCE X307-3:

Before * is affected.

Siemens SCALANCE X307-3LD:

Before * is affected.

Siemens SCALANCE X307-3LD:

Before * is affected.

Siemens SCALANCE X308-2:

Before * is affected.

Siemens SCALANCE X308-2:

Before * is affected.

Siemens SCALANCE X308-2LD:

Before * is affected.

Siemens SCALANCE X308-2LD:

Before * is affected.

Siemens SCALANCE X308-2LH:

Before * is affected.

Siemens SCALANCE X308-2LH:

Before * is affected.

Siemens SCALANCE X308-2LH+:

Before * is affected.

Siemens SCALANCE X308-2LH+:

Before * is affected.

Siemens SCALANCE X308-2M:

Before * is affected.

Siemens SCALANCE X308-2M:

Before * is affected.

Siemens SCALANCE X308-2M PoE:

Before * is affected.

Siemens SCALANCE X308-2M PoE:

Before * is affected.

Siemens SCALANCE X308-2M TS:

Before * is affected.

Siemens SCALANCE X308-2M TS:

Before * is affected.

Siemens SCALANCE X310:

Before * is affected.

Siemens SCALANCE X310:

Before * is affected.

Siemens SCALANCE X310FE:

Before * is affected.

Siemens SCALANCE X310FE:

Before * is affected.

Siemens SCALANCE X320-1 FE:

Before * is affected.

Siemens SCALANCE X320-1-2LD FE:

Before * is affected.

Siemens SCALANCE X408-2:

Before * is affected.

Siemens SCALANCE XC316-8:

Before * is affected.

Siemens SCALANCE XC324-4:

Before * is affected.

Siemens SCALANCE XC324-4 EEC:

Before * is affected.

Siemens SCALANCE XC332:

Before * is affected.

Siemens SCALANCE XC416-8:

Before * is affected.

Siemens SCALANCE XC424-4:

Before * is affected.

Siemens SCALANCE XC432:

Before * is affected.

Siemens SCALANCE XF201-3P IRT:

Before * is affected.

Siemens SCALANCE XF202-2P IRT:

Before * is affected.

Siemens SCALANCE XF204:

Before * is affected.

Siemens SCALANCE XF204-2:

Before * is affected.

Siemens SCALANCE XF204-2BA IRT:

Before * is affected.

Siemens SCALANCE XF204IRT:

Before * is affected.

Siemens SCALANCE XF204IRT:

Before * is affected.

Siemens SCALANCE XF206-1:

Before * is affected.

Siemens SCALANCE XF208:

Before * is affected.

Siemens SCALANCE XR302-32:

Before * is affected.

Siemens SCALANCE XR302-32:

Before * is affected.

Siemens SCALANCE XR302-32:

Before * is affected.

Siemens SCALANCE XR322-12:

Before * is affected.

Siemens SCALANCE XR322-12:

Before * is affected.

Siemens SCALANCE XR322-12:

Before * is affected.

Siemens SCALANCE XR324-12M (230V, ports on front):

Before * is affected.

Siemens SCALANCE XR324-12M (230V, ports on front):

Before * is affected.

Siemens SCALANCE XR324-12M (230V, ports on rear):

Before * is affected.

Siemens SCALANCE XR324-12M (230V, ports on rear):

Before * is affected.

Siemens SCALANCE XR324-12M (24V, ports on front):

Before * is affected.

Siemens SCALANCE XR324-12M (24V, ports on front):

Before * is affected.

Siemens SCALANCE XR324-12M (24V, ports on rear):

Before * is affected.

Siemens SCALANCE XR324-12M (24V, ports on rear):

Before * is affected.

Siemens SCALANCE XR324-12M TS (24V):

Before * is affected.

Siemens SCALANCE XR324-12M TS (24V):

Before * is affected.

Siemens SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on front):

Before * is affected.

Siemens SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on front):

Before * is affected.

Siemens SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on rear):

Before * is affected.

Siemens SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on rear):

Before * is affected.

Siemens SCALANCE XR324-4M EEC (24V, ports on front):

Before * is affected.

Siemens SCALANCE XR324-4M EEC (24V, ports on front):

Before * is affected.

Siemens SCALANCE XR324-4M EEC (24V, ports on rear):

Before * is affected.

Siemens SCALANCE XR324-4M EEC (24V, ports on rear):

Before * is affected.

Siemens SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on front):

Before * is affected.

Siemens SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on front):

Before * is affected.

Siemens SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on rear):

Before * is affected.

Siemens SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on rear):

Before * is affected.

Siemens SCALANCE XR324-4M EEC (2x 24V, ports on front):

Before * is affected.

Siemens SCALANCE XR324-4M EEC (2x 24V, ports on front):

Before * is affected.

Siemens SCALANCE XR324-4M EEC (2x 24V, ports on rear):

Before * is affected.

Siemens SCALANCE XR324-4M EEC (2x 24V, ports on rear):

Before * is affected.

Siemens SCALANCE XR324-4M PoE (230V, ports on front):

Before * is affected.

Siemens SCALANCE XR324-4M PoE (230V, ports on front):

Before * is affected.

Siemens SCALANCE XR324-4M PoE (230V, ports on rear):

Before * is affected.

Siemens SCALANCE XR324-4M PoE (230V, ports on rear):

Before * is affected.

Siemens SCALANCE XR324-4M PoE (24V, ports on front):

Before * is affected.

Siemens SCALANCE XR324-4M PoE (24V, ports on front):

Before * is affected.

Siemens SCALANCE XR324-4M PoE (24V, ports on rear):

Before * is affected.

Siemens SCALANCE XR324-4M PoE (24V, ports on rear):

Before * is affected.

Siemens SCALANCE XR324-4M PoE TS (24V, ports on front):

Before * is affected.

Siemens SCALANCE XR324-4M PoE TS (24V, ports on front):

Before * is affected.

Siemens SCALANCE XR326-8:

Before * is affected.

Siemens SCALANCE XR326-8:

Before * is affected.

Siemens SCALANCE XR326-8:

Before * is affected.

Siemens SCALANCE XR326-8 EEC:

Before * is affected.

Siemens SCALANCE XR502-32:

Before * is affected.

Siemens SCALANCE XR502-32:

Before * is affected.

Siemens SCALANCE XR502-32:

Before * is affected.

Siemens SCALANCE XR522-12:

Before * is affected.

Siemens SCALANCE XR522-12:

Before * is affected.

Siemens SCALANCE XR522-12:

Before * is affected.

Siemens SCALANCE XR524-8WG:

Before * is affected.

Siemens SCALANCE XR524-8WG:

Before * is affected.

Siemens SCALANCE XR524-8WG:

Before * is affected.

Siemens SCALANCE XR524-8WG:

Before * is affected.

Siemens SCALANCE XR526-8:

Before * is affected.

Siemens SCALANCE XR526-8:

Before * is affected.

Siemens SCALANCE XR526-8:

Before * is affected.

Siemens Shopfloor IT Suite:

Before * is affected.

Siemens SIDIS Prime:

Version V4.0.700 and below * is affected.

Siemens OPC UA Modelling Editor (SiOME):

Before * is affected.

Siemens SIMATIC Comfort/Mobile RT:

Before * is affected.

Siemens SIMATIC eaSie Core Package:

Before * is affected.

Siemens SIMATIC eaSie PCS 7 Skill Package:

Before * is affected.

Siemens SIMATIC HMI Basic Panels:

Before V17.9 is affected.

Siemens SIMATIC HMI Comfort Panels:

Before V17.9 is affected.

Siemens SIMATIC HMI Mobile Panels:

Before V17 Update 9 is affected.

Siemens SIMATIC IOT2050:

Before * is affected.

Siemens SIMATIC IPC BX-21A:

Before * is affected.

Siemens SIMATIC IPC MD-57A:

Before * is affected.

Siemens SIMATIC IPC ORCLA:

Before * is affected.

Siemens SIMATIC MV530 H:

Before * is affected.

Siemens SIMATIC MV530 S:

Before * is affected.

Siemens SIMATIC MV540 H:

Before * is affected.

Siemens SIMATIC MV540 H CRANES:

Before * is affected.

Siemens SIMATIC MV540 S:

Before * is affected.

Siemens SIMATIC MV550 H:

Before * is affected.

Siemens SIMATIC MV550 S:

Before * is affected.

Siemens SIMATIC MV560 U:

Before * is affected.

Siemens SIMATIC MV560 X:

Before * is affected.

Siemens SIMATIC PDM V9.3:

Before * is affected.