CVE-2025-9230

/// Technical description

Issue summary: An application trying to decrypt CMS messages encrypted using

password based encryption can trigger an out-of-bounds read and write.

Impact summary: This out-of-bounds read may trigger a crash which leads to

Denial of Service for an application. The out-of-bounds write can cause

a memory corruption which can have various consequences including

a Denial of Service or Execution of attacker-supplied code.

Although the consequences of a successful exploit of this vulnerability

could be severe, the probability that the attacker would be able to

perform it is low. Besides, password based (PWRI) encryption support in CMS

messages is very rarely used. For that reason the issue was assessed as

Moderate severity according to our Security Policy.

The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this

issue, as the CMS implementation is outside the OpenSSL FIPS module

boundary.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References