CVE-2025-15467

Fixed in a distro release EPSS 75%CVSS 8.8

Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote code execution. When parsing CMS (Auth)EnvelopedData structures that use AEAD ciphers such as AES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is copied into a fixed-size stack buffer without verifying that its length fits the destination. An attacker can supply a crafted CMS message with an oversized IV, causing a stack-based out-of-bounds write before any authentication or tag verification occurs. Applications and services that parse untrusted CMS or PKCS#7 content using AEAD ciphers (e.g., S/MIME (Auth)EnvelopedData with AES-GCM) are vulnerable. Because the overflow occurs prior to authentication, no valid key material is required to trigger it. While exploitability to remote code execution depends on platform and toolchain mitigations, the stack-based write primitive represents a severe risk. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue. OpenSSL 1.1.1 and 1.0.2 are not affected by this issue.

Published 2026-01-27 · CVE record · OSV

Products: OpenSSL, Siemens AI Lightweight Inference Server, Siemens Connector for Azure, Siemens Databus, Siemens Desigo CC family V7, Siemens Desigo CC family V8, Siemens Desigo CC family V9, Siemens HiMed Cockpit, Siemens RUGGEDCOM RM1224 LTE(4G) EU, Siemens RUGGEDCOM RM1224 LTE(4G) NAM, Siemens RUGGEDCOM ROX MX5000, Siemens RUGGEDCOM ROX MX5000RE, Siemens RUGGEDCOM ROX RX1400, Siemens RUGGEDCOM ROX RX1500, Siemens RUGGEDCOM ROX RX1501, Siemens RUGGEDCOM ROX RX1510, Siemens RUGGEDCOM ROX RX1511, Siemens RUGGEDCOM ROX RX1512, Siemens RUGGEDCOM ROX RX1524, Siemens RUGGEDCOM ROX RX1536, Siemens RUGGEDCOM ROX RX5000, Siemens SCALANCE LPE9403, Siemens SCALANCE LPE9413, Siemens SCALANCE LPE9433, Siemens SCALANCE M804PB, Siemens SCALANCE M812-1 ADSL-Router family, Siemens SCALANCE M816-1 ADSL-Router family, Siemens SCALANCE M826-2 SHDSL-Router, Siemens SCALANCE M874-2, Siemens SCALANCE M874-3, Siemens SCALANCE M874-3 3G-Router (CN), Siemens SCALANCE M876-3, Siemens SCALANCE M876-3 (ROK), Siemens SCALANCE M876-4, Siemens SCALANCE M876-4 (EU), Siemens SCALANCE M876-4 (NAM), Siemens SCALANCE MUB852-1 (A1), Siemens SCALANCE MUB852-1 (B1), Siemens SCALANCE MUM853-1 (A1), Siemens SCALANCE MUM853-1 (B1), Siemens SCALANCE MUM853-1 (EU), Siemens SCALANCE MUM856-1 (A1), Siemens SCALANCE MUM856-1 (B1), Siemens SCALANCE MUM856-1 (CN), Siemens SCALANCE MUM856-1 (EU), Siemens SCALANCE MUM856-1 (RoW), Siemens SCALANCE S615 EEC LAN-Router, Siemens SCALANCE S615 LAN-Router, Siemens SCALANCE SC622-2C, Siemens SCALANCE SC626-2C, Siemens SCALANCE SC632-2C, Siemens SCALANCE SC636-2C, Siemens SCALANCE SC642-2C, Siemens SCALANCE SC646-2C, Siemens SCALANCE WAB762-1, Siemens SCALANCE WAM763-1, Siemens SCALANCE WAM763-1 (ME), Siemens SCALANCE WAM763-1 (US), Siemens SCALANCE WAM766-1, Siemens SCALANCE WAM766-1 (ME), Siemens SCALANCE WAM766-1 (US), Siemens SCALANCE WAM766-1 EEC, Siemens SCALANCE WAM766-1 EEC (ME), Siemens SCALANCE WAM766-1 EEC (US), Siemens SCALANCE WUB762-1, Siemens SCALANCE WUB762-1 iFeatures, Siemens SCALANCE WUM763-1, Siemens SCALANCE WUM763-1 (US), Siemens SCALANCE WUM766-1, Siemens SCALANCE WUM766-1 (ME), Siemens SCALANCE WUM766-1 (USA), Siemens SCALANCE X200-4P IRT, Siemens SCALANCE X201-3P IRT, Siemens SCALANCE X201-3P IRT PRO, Siemens SCALANCE X202-2IRT, Siemens SCALANCE X202-2P IRT, Siemens SCALANCE X202-2P IRT PRO, Siemens SCALANCE X204-2, Siemens SCALANCE X204-2FM, Siemens SCALANCE X204-2LD, Siemens SCALANCE X204-2LD TS, Siemens SCALANCE X204-2TS, Siemens SCALANCE X204IRT, Siemens SCALANCE X204IRT PRO, Siemens SCALANCE X204RNA (HSR), Siemens SCALANCE X204RNA (PRP), Siemens SCALANCE X204RNA EEC (HSR), Siemens SCALANCE X204RNA EEC (PRP), Siemens SCALANCE X204RNA EEC (PRP/HSR), Siemens SCALANCE X206-1, Siemens SCALANCE X206-1LD, Siemens SCALANCE X208, Siemens SCALANCE X208PRO, Siemens SCALANCE X212-2, Siemens SCALANCE X212-2LD, Siemens SCALANCE X216, Siemens SCALANCE X224, Siemens SCALANCE X302-7 EEC (230V, coated), Siemens SCALANCE X302-7 EEC (230V), Siemens SCALANCE X302-7 EEC (24V, coated), Siemens SCALANCE X302-7 EEC (24V), Siemens SCALANCE X302-7 EEC (2x 230V, coated), Siemens SCALANCE X302-7 EEC (2x 230V), Siemens SCALANCE X302-7 EEC (2x 24V, coated), Siemens SCALANCE X302-7 EEC (2x 24V), Siemens SCALANCE X304-2FE, Siemens SCALANCE X306-1LD FE, Siemens SCALANCE X307-2 EEC (230V, coated), Siemens SCALANCE X307-2 EEC (230V), Siemens SCALANCE X307-2 EEC (24V, coated), Siemens SCALANCE X307-2 EEC (24V), Siemens SCALANCE X307-2 EEC (2x 230V, coated), Siemens SCALANCE X307-2 EEC (2x 230V), Siemens SCALANCE X307-2 EEC (2x 24V, coated), Siemens SCALANCE X307-2 EEC (2x 24V), Siemens SCALANCE X307-3, Siemens SCALANCE X307-3LD, Siemens SCALANCE X308-2, Siemens SCALANCE X308-2LD, Siemens SCALANCE X308-2LH, Siemens SCALANCE X308-2M, Siemens SCALANCE X308-2M PoE, Siemens SCALANCE X308-2M TS, Siemens SCALANCE X310, Siemens SCALANCE X310FE, Siemens SCALANCE X320-1 FE, Siemens SCALANCE X320-1-2LD FE, Siemens SCALANCE X408-2, Siemens SCALANCE XC316-8, Siemens SCALANCE XC324-4, Siemens SCALANCE XC324-4 EEC, Siemens SCALANCE XC332, Siemens SCALANCE XC416-8, Siemens SCALANCE XC424-4, Siemens SCALANCE XC432, Siemens SCALANCE XF201-3P IRT, Siemens SCALANCE XF202-2P IRT, Siemens SCALANCE XF204, Siemens SCALANCE XF204-2, Siemens SCALANCE XF204-2BA IRT, Siemens SCALANCE XF204IRT, Siemens SCALANCE XF206-1, Siemens SCALANCE XF208, Siemens SCALANCE XR302-32, Siemens SCALANCE XR322-12, Siemens SCALANCE XR324-12M (230V, ports on front), Siemens SCALANCE XR324-12M (230V, ports on rear), Siemens SCALANCE XR324-12M (24V, ports on front), Siemens SCALANCE XR324-12M (24V, ports on rear), Siemens SCALANCE XR324-12M TS (24V), Siemens SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on front), Siemens SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on rear), Siemens SCALANCE XR324-4M EEC (24V, ports on front), Siemens SCALANCE XR324-4M EEC (24V, ports on rear), Siemens SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on front), Siemens SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on rear), Siemens SCALANCE XR324-4M EEC (2x 24V, ports on front), Siemens SCALANCE XR324-4M EEC (2x 24V, ports on rear), Siemens SCALANCE XR324-4M PoE (230V, ports on front), Siemens SCALANCE XR324-4M PoE (230V, ports on rear), Siemens SCALANCE XR324-4M PoE (24V, ports on front), Siemens SCALANCE XR324-4M PoE (24V, ports on rear), Siemens SCALANCE XR324-4M PoE TS (24V, ports on front), Siemens SCALANCE XR326-8, Siemens SCALANCE XR326-8 EEC, Siemens SCALANCE XR502-32, Siemens SCALANCE XR522-12, Siemens SCALANCE XR524-8WG, Siemens SCALANCE XR526-8, Siemens Shopfloor IT Suite, Siemens SIDIS Prime, Siemens OPC UA Modelling Editor (SiOME), Siemens SIMATIC eaSie Core Package, Siemens SIMATIC eaSie PCS 7 Skill Package, Siemens SIMATIC HMI Basic Panels, Siemens SIMATIC HMI Comfort Panels, Siemens SIMATIC HMI Mobile Panels, Siemens SIMATIC Industrial Thin Client, Siemens SIMATIC IoT2050 Advanced, Siemens SIMATIC IPC BX-21A, Siemens SIMATIC IPC MD-57A, Siemens SIMATIC IPC ORCLA, Siemens SIMATIC Logon V1.6, Siemens SIMATIC Logon V2.0, Siemens SIMATIC MV530 H, Siemens SIMATIC MV530 S, Siemens SIMATIC MV540 H, Siemens SIMATIC MV540 H CRANES, Siemens SIMATIC MV540 S, Siemens SIMATIC MV550 H, Siemens SIMATIC MV550 S, Siemens SIMATIC MV560 U, Siemens SIMATIC MV560 X, Siemens SIMATIC PCS neo V6.0, Siemens SIMATIC PDM V9.3, Siemens SIMATIC RTLS Locating Manager, Siemens SIMATIC STEP 7 V5, Siemens SIMATIC Target, Siemens SIMATIC WinCC OA V3.19, Siemens SIMATIC WinCC OA V3.20, Siemens SIMATIC WinCC OA V3.21, Siemens SIMATIC WinCC Runtime Advanced V17, Siemens SIMATIC WinCC Unified Sequence, Siemens SIMATIC WinCC V7.5, Siemens SIMATIC WinCC V8.0, Siemens SIMATIC WinCC V8.1, Siemens SIMOTION OACAMGEN, Siemens SIMOVE Fleetmanager V3.1, Siemens SIMOVE Fleetmanager V3.2, Siemens SIMOVE Fleetmanager V3.3, Siemens SINAMICS G200, Siemens SINAMICS G220, Siemens SINAMICS S200, Siemens SINAMICS S210, Siemens SINAMICS S220, Siemens SINEC INS, Siemens SINEC NMS, Siemens SINEC Security Monitor, Siemens SINUMERIK Access MyMachine /OPC UA, Siemens SIPLANT, Siemens SIPLUS NET SCALANCE X202-2P IRT, Siemens SIPLUS NET SCALANCE X308-2, Siemens SITRANS ASM IQ, Siemens SITRANS Soft Sensor Engine IQ (SITRANS SSE IQ), Siemens User Management Component (UMC), Siemens Visual Inspection Cockpit, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.4 Extended Update Support, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat JBoss Core Services 2.4.62.SP3, Red Hat OpenShift Container Platform 4.13, Red Hat OpenShift Container Platform 4.14, Red Hat OpenShift Container Platform 4.15, Red Hat OpenShift Container Platform 4.16, Red Hat OpenShift Container Platform 4.17, Red Hat OpenShift Container Platform 4.18, Red Hat OpenShift Container Platform 4.19, Red Hat OpenShift Container Platform 4.20, Red Hat Service Interconnect 1 for RHEL 9, Red Hat Cost Management 4, Red Hat AI Inference Server 3.2, Red Hat Discovery 2, Red Hat Hardened Images, Red Hat Insights proxy 1.5, Red Hat OpenShift Dev Spaces (RHOSDS) 3.26, Red Hat Update Infrastructure 5, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat OpenShift Container Platform 4

Distro releases