Vulnerability-Lookup

RHSA-2026:2776

Vulnerability from csaf_opensuse - Published: 2026-02-17 09:30 - Updated: 2026-10-31 15:37

Summary

Red Hat Security Advisory: edk2 security update

Severity

Moderate

Notes

Topic: An update for edk2 is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fix(es): * openssl: Out-of-bounds read & write in RFC 3211 KEK Unwrap (CVE-2025-9230) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2025-9230

A flaw was found in the OpenSSL CMS implementation (RFC 3211 KEK Unwrap). This vulnerability allows memory corruption, an application level denial of service, or potential execution of attacker-supplied code via crafted CMS messages using password-based encryption (PWRI).

5.6 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

CWE-787 - Out-of-bounds Write

Affected products

Fixed 12 products

Product	Version	Remediation
Unresolved product id: AppStream-9.7.0.Z.MAIN:edk2-0:20241117-4.el9_7.3.src	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.7.0.Z.MAIN:edk2-aarch64-0:20241117-4.el9_7.3.noarch	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.7.0.Z.MAIN:edk2-ovmf-0:20241117-4.el9_7.3.noarch	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.7.0.Z.MAIN:edk2-aarch64-0:20241117-4.el9_7.3.noarch	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.7.0.Z.MAIN:edk2-debugsource-0:20241117-4.el9_7.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.7.0.Z.MAIN:edk2-debugsource-0:20241117-4.el9_7.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.7.0.Z.MAIN:edk2-ovmf-0:20241117-4.el9_7.3.noarch	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.7.0.Z.MAIN:edk2-tools-0:20241117-4.el9_7.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.7.0.Z.MAIN:edk2-tools-0:20241117-4.el9_7.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.7.0.Z.MAIN:edk2-tools-debuginfo-0:20241117-4.el9_7.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.7.0.Z.MAIN:edk2-tools-debuginfo-0:20241117-4.el9_7.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.7.0.Z.MAIN:edk2-tools-doc-0:20241117-4.el9_7.3.noarch	—	Vendor Fix fix Workaround

Threats

Impact Moderate

References

8 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:2776	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2396054	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2025-9230	self
https://bugzilla.redhat.com/show_bug.cgi?id=2396054	external
https://www.cve.org/CVERecord?id=CVE-2025-9230	external
https://nvd.nist.gov/vuln/detail/CVE-2025-9230	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for edk2 is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. \n\nSecurity Fix(es):\n\n* openssl: Out-of-bounds read \u0026 write in RFC 3211 KEK Unwrap (CVE-2025-9230)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:2776",
        "url": "https://access.redhat.com/errata/RHSA-2026:2776"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "2396054",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2396054"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2776.json"
      }
    ],
    "title": "Red Hat Security Advisory: edk2 security update",
    "tracking": {
      "current_release_date": "2026-10-31T15:37:28+00:00",
      "generator": {
        "date": "2026-10-31T15:37:28+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.4"
        }
      },
      "id": "RHSA-2026:2776",
      "initial_release_date": "2026-02-17T09:30:25+00:00",
      "revision_history": [
        {
          "date": "2026-02-17T09:30:25+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-02-17T09:30:25+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-10-31T15:37:28+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                  "product_id": "AppStream-9.7.0.Z.MAIN",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:9::appstream"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)",
                "product": {
                  "name": "Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)",
                  "product_id": "CRB-9.7.0.Z.MAIN",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:9::crb"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "edk2-0:20241117-4.el9_7.3.src",
                "product": {
                  "name": "edk2-0:20241117-4.el9_7.3.src",
                  "product_id": "edk2-0:20241117-4.el9_7.3.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/edk2@20241117-4.el9_7.3?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "edk2-aarch64-0:20241117-4.el9_7.3.noarch",
                "product": {
                  "name": "edk2-aarch64-0:20241117-4.el9_7.3.noarch",
                  "product_id": "edk2-aarch64-0:20241117-4.el9_7.3.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/edk2-aarch64@20241117-4.el9_7.3?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "edk2-ovmf-0:20241117-4.el9_7.3.noarch",
                "product": {
                  "name": "edk2-ovmf-0:20241117-4.el9_7.3.noarch",
                  "product_id": "edk2-ovmf-0:20241117-4.el9_7.3.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/edk2-ovmf@20241117-4.el9_7.3?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "edk2-tools-doc-0:20241117-4.el9_7.3.noarch",
                "product": {
                  "name": "edk2-tools-doc-0:20241117-4.el9_7.3.noarch",
                  "product_id": "edk2-tools-doc-0:20241117-4.el9_7.3.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/edk2-tools-doc@20241117-4.el9_7.3?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "edk2-tools-0:20241117-4.el9_7.3.aarch64",
                "product": {
                  "name": "edk2-tools-0:20241117-4.el9_7.3.aarch64",
                  "product_id": "edk2-tools-0:20241117-4.el9_7.3.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/edk2-tools@20241117-4.el9_7.3?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "edk2-debugsource-0:20241117-4.el9_7.3.aarch64",
                "product": {
                  "name": "edk2-debugsource-0:20241117-4.el9_7.3.aarch64",
                  "product_id": "edk2-debugsource-0:20241117-4.el9_7.3.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/edk2-debugsource@20241117-4.el9_7.3?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "edk2-tools-debuginfo-0:20241117-4.el9_7.3.aarch64",
                "product": {
                  "name": "edk2-tools-debuginfo-0:20241117-4.el9_7.3.aarch64",
                  "product_id": "edk2-tools-debuginfo-0:20241117-4.el9_7.3.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/edk2-tools-debuginfo@20241117-4.el9_7.3?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "edk2-tools-0:20241117-4.el9_7.3.x86_64",
                "product": {
                  "name": "edk2-tools-0:20241117-4.el9_7.3.x86_64",
                  "product_id": "edk2-tools-0:20241117-4.el9_7.3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/edk2-tools@20241117-4.el9_7.3?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "edk2-debugsource-0:20241117-4.el9_7.3.x86_64",
                "product": {
                  "name": "edk2-debugsource-0:20241117-4.el9_7.3.x86_64",
                  "product_id": "edk2-debugsource-0:20241117-4.el9_7.3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/edk2-debugsource@20241117-4.el9_7.3?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "edk2-tools-debuginfo-0:20241117-4.el9_7.3.x86_64",
                "product": {
                  "name": "edk2-tools-debuginfo-0:20241117-4.el9_7.3.x86_64",
                  "product_id": "edk2-tools-debuginfo-0:20241117-4.el9_7.3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/edk2-tools-debuginfo@20241117-4.el9_7.3?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "edk2-0:20241117-4.el9_7.3.src as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:edk2-0:20241117-4.el9_7.3.src"
        },
        "product_reference": "edk2-0:20241117-4.el9_7.3.src",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "edk2-aarch64-0:20241117-4.el9_7.3.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:edk2-aarch64-0:20241117-4.el9_7.3.noarch"
        },
        "product_reference": "edk2-aarch64-0:20241117-4.el9_7.3.noarch",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "edk2-ovmf-0:20241117-4.el9_7.3.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:edk2-ovmf-0:20241117-4.el9_7.3.noarch"
        },
        "product_reference": "edk2-ovmf-0:20241117-4.el9_7.3.noarch",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "edk2-aarch64-0:20241117-4.el9_7.3.noarch as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)",
          "product_id": "CRB-9.7.0.Z.MAIN:edk2-aarch64-0:20241117-4.el9_7.3.noarch"
        },
        "product_reference": "edk2-aarch64-0:20241117-4.el9_7.3.noarch",
        "relates_to_product_reference": "CRB-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "edk2-debugsource-0:20241117-4.el9_7.3.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)",
          "product_id": "CRB-9.7.0.Z.MAIN:edk2-debugsource-0:20241117-4.el9_7.3.aarch64"
        },
        "product_reference": "edk2-debugsource-0:20241117-4.el9_7.3.aarch64",
        "relates_to_product_reference": "CRB-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "edk2-debugsource-0:20241117-4.el9_7.3.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)",
          "product_id": "CRB-9.7.0.Z.MAIN:edk2-debugsource-0:20241117-4.el9_7.3.x86_64"
        },
        "product_reference": "edk2-debugsource-0:20241117-4.el9_7.3.x86_64",
        "relates_to_product_reference": "CRB-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "edk2-ovmf-0:20241117-4.el9_7.3.noarch as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)",
          "product_id": "CRB-9.7.0.Z.MAIN:edk2-ovmf-0:20241117-4.el9_7.3.noarch"
        },
        "product_reference": "edk2-ovmf-0:20241117-4.el9_7.3.noarch",
        "relates_to_product_reference": "CRB-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "edk2-tools-0:20241117-4.el9_7.3.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)",
          "product_id": "CRB-9.7.0.Z.MAIN:edk2-tools-0:20241117-4.el9_7.3.aarch64"
        },
        "product_reference": "edk2-tools-0:20241117-4.el9_7.3.aarch64",
        "relates_to_product_reference": "CRB-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "edk2-tools-0:20241117-4.el9_7.3.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)",
          "product_id": "CRB-9.7.0.Z.MAIN:edk2-tools-0:20241117-4.el9_7.3.x86_64"
        },
        "product_reference": "edk2-tools-0:20241117-4.el9_7.3.x86_64",
        "relates_to_product_reference": "CRB-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "edk2-tools-debuginfo-0:20241117-4.el9_7.3.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)",
          "product_id": "CRB-9.7.0.Z.MAIN:edk2-tools-debuginfo-0:20241117-4.el9_7.3.aarch64"
        },
        "product_reference": "edk2-tools-debuginfo-0:20241117-4.el9_7.3.aarch64",
        "relates_to_product_reference": "CRB-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "edk2-tools-debuginfo-0:20241117-4.el9_7.3.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)",
          "product_id": "CRB-9.7.0.Z.MAIN:edk2-tools-debuginfo-0:20241117-4.el9_7.3.x86_64"
        },
        "product_reference": "edk2-tools-debuginfo-0:20241117-4.el9_7.3.x86_64",
        "relates_to_product_reference": "CRB-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "edk2-tools-doc-0:20241117-4.el9_7.3.noarch as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)",
          "product_id": "CRB-9.7.0.Z.MAIN:edk2-tools-doc-0:20241117-4.el9_7.3.noarch"
        },
        "product_reference": "edk2-tools-doc-0:20241117-4.el9_7.3.noarch",
        "relates_to_product_reference": "CRB-9.7.0.Z.MAIN"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-9230",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2025-09-17T12:15:34.387000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2396054"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the OpenSSL CMS implementation (RFC 3211 KEK Unwrap). This vulnerability allows memory corruption, an application level denial of service, or potential execution of attacker-supplied code via crafted CMS messages using password-based encryption (PWRI).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: Out-of-bounds read \u0026 write in RFC 3211 KEK Unwrap",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The vulnerability was rated as Moderate because, while the potential impact includes an application level denial of service and possible arbitrary code execution, successful exploitation is considered unlikely due to the high attack complexity and the fact that password-based CMS encryption (PWRI) is rarely used in real-world deployments.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.7.0.Z.MAIN:edk2-0:20241117-4.el9_7.3.src",
          "AppStream-9.7.0.Z.MAIN:edk2-aarch64-0:20241117-4.el9_7.3.noarch",
          "AppStream-9.7.0.Z.MAIN:edk2-ovmf-0:20241117-4.el9_7.3.noarch",
          "CRB-9.7.0.Z.MAIN:edk2-aarch64-0:20241117-4.el9_7.3.noarch",
          "CRB-9.7.0.Z.MAIN:edk2-debugsource-0:20241117-4.el9_7.3.aarch64",
          "CRB-9.7.0.Z.MAIN:edk2-debugsource-0:20241117-4.el9_7.3.x86_64",
          "CRB-9.7.0.Z.MAIN:edk2-ovmf-0:20241117-4.el9_7.3.noarch",
          "CRB-9.7.0.Z.MAIN:edk2-tools-0:20241117-4.el9_7.3.aarch64",
          "CRB-9.7.0.Z.MAIN:edk2-tools-0:20241117-4.el9_7.3.x86_64",
          "CRB-9.7.0.Z.MAIN:edk2-tools-debuginfo-0:20241117-4.el9_7.3.aarch64",
          "CRB-9.7.0.Z.MAIN:edk2-tools-debuginfo-0:20241117-4.el9_7.3.x86_64",
          "CRB-9.7.0.Z.MAIN:edk2-tools-doc-0:20241117-4.el9_7.3.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-9230"
        },
        {
          "category": "external",
          "summary": "RHBZ#2396054",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2396054"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-9230",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-9230"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-9230",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9230"
        }
      ],
      "release_date": "2025-09-30T23:59:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-02-17T09:30:25+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.7.0.Z.MAIN:edk2-0:20241117-4.el9_7.3.src",
            "AppStream-9.7.0.Z.MAIN:edk2-aarch64-0:20241117-4.el9_7.3.noarch",
            "AppStream-9.7.0.Z.MAIN:edk2-ovmf-0:20241117-4.el9_7.3.noarch",
            "CRB-9.7.0.Z.MAIN:edk2-aarch64-0:20241117-4.el9_7.3.noarch",
            "CRB-9.7.0.Z.MAIN:edk2-debugsource-0:20241117-4.el9_7.3.aarch64",
            "CRB-9.7.0.Z.MAIN:edk2-debugsource-0:20241117-4.el9_7.3.x86_64",
            "CRB-9.7.0.Z.MAIN:edk2-ovmf-0:20241117-4.el9_7.3.noarch",
            "CRB-9.7.0.Z.MAIN:edk2-tools-0:20241117-4.el9_7.3.aarch64",
            "CRB-9.7.0.Z.MAIN:edk2-tools-0:20241117-4.el9_7.3.x86_64",
            "CRB-9.7.0.Z.MAIN:edk2-tools-debuginfo-0:20241117-4.el9_7.3.aarch64",
            "CRB-9.7.0.Z.MAIN:edk2-tools-debuginfo-0:20241117-4.el9_7.3.x86_64",
            "CRB-9.7.0.Z.MAIN:edk2-tools-doc-0:20241117-4.el9_7.3.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:2776"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.7.0.Z.MAIN:edk2-0:20241117-4.el9_7.3.src",
            "AppStream-9.7.0.Z.MAIN:edk2-aarch64-0:20241117-4.el9_7.3.noarch",
            "AppStream-9.7.0.Z.MAIN:edk2-ovmf-0:20241117-4.el9_7.3.noarch",
            "CRB-9.7.0.Z.MAIN:edk2-aarch64-0:20241117-4.el9_7.3.noarch",
            "CRB-9.7.0.Z.MAIN:edk2-debugsource-0:20241117-4.el9_7.3.aarch64",
            "CRB-9.7.0.Z.MAIN:edk2-debugsource-0:20241117-4.el9_7.3.x86_64",
            "CRB-9.7.0.Z.MAIN:edk2-ovmf-0:20241117-4.el9_7.3.noarch",
            "CRB-9.7.0.Z.MAIN:edk2-tools-0:20241117-4.el9_7.3.aarch64",
            "CRB-9.7.0.Z.MAIN:edk2-tools-0:20241117-4.el9_7.3.x86_64",
            "CRB-9.7.0.Z.MAIN:edk2-tools-debuginfo-0:20241117-4.el9_7.3.aarch64",
            "CRB-9.7.0.Z.MAIN:edk2-tools-debuginfo-0:20241117-4.el9_7.3.x86_64",
            "CRB-9.7.0.Z.MAIN:edk2-tools-doc-0:20241117-4.el9_7.3.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.7.0.Z.MAIN:edk2-0:20241117-4.el9_7.3.src",
            "AppStream-9.7.0.Z.MAIN:edk2-aarch64-0:20241117-4.el9_7.3.noarch",
            "AppStream-9.7.0.Z.MAIN:edk2-ovmf-0:20241117-4.el9_7.3.noarch",
            "CRB-9.7.0.Z.MAIN:edk2-aarch64-0:20241117-4.el9_7.3.noarch",
            "CRB-9.7.0.Z.MAIN:edk2-debugsource-0:20241117-4.el9_7.3.aarch64",
            "CRB-9.7.0.Z.MAIN:edk2-debugsource-0:20241117-4.el9_7.3.x86_64",
            "CRB-9.7.0.Z.MAIN:edk2-ovmf-0:20241117-4.el9_7.3.noarch",
            "CRB-9.7.0.Z.MAIN:edk2-tools-0:20241117-4.el9_7.3.aarch64",
            "CRB-9.7.0.Z.MAIN:edk2-tools-0:20241117-4.el9_7.3.x86_64",
            "CRB-9.7.0.Z.MAIN:edk2-tools-debuginfo-0:20241117-4.el9_7.3.aarch64",
            "CRB-9.7.0.Z.MAIN:edk2-tools-debuginfo-0:20241117-4.el9_7.3.x86_64",
            "CRB-9.7.0.Z.MAIN:edk2-tools-doc-0:20241117-4.el9_7.3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssl: Out-of-bounds read \u0026 write in RFC 3211 KEK Unwrap"
    }
  ]
}

CVE-2025-9230 (GCVE-0-2025-9230)

Vulnerability from cvelistv5 – Published: 2025-09-30 13:17 – Updated: 2026-10-15 01:02

Title

Out-of-bounds read & write in RFC 3211 KEK Unwrap

Summary

Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application. The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service or Execution of attacker-supplied code. Although the consequences of a successful exploit of this vulnerability could be severe, the probability that the attacker would be able to perform it is low. Besides, password based (PWRI) encryption support in CMS messages is very rarely used. For that reason the issue was assessed as Moderate severity according to our Security Policy. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-09-30 19:30 UTC

CWE

CWE-125 - Out-of-bounds Read
CWE-787 - Out-of-bounds Write

Assigner

openssl CNA under the mitre root

CNA scorecard B 78/100 over 43 records in the last 180 days details

References

17 references

URL	Tags
https://openssl-library.org/news/secadv/20250930.txt	vendor-advisory
https://github.com/openssl/openssl/commit/bae259a…	patch
https://github.com/openssl/openssl/commit/9e91358…	patch
https://github.com/openssl/openssl/commit/5965ea5…	patch
https://github.com/openssl/openssl/commit/b5282d6…	patch
https://github.com/openssl/openssl/commit/a79c4ce…	patch
https://github.openssl.org/openssl/extended-relea…	patch
https://github.openssl.org/openssl/extended-relea…	patch
https://lists.debian.org/debian-lts-announce/2025…
http://www.openwall.com/lists/oss-security/2025/09/30/5
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

25 products

Vendor	Product	Version
OpenSSL	OpenSSL	Affected: 3.5.0 , < 3.5.4 (semver) Affected: 3.4.0 , < 3.4.3 (semver) Affected: 3.3.0 , < 3.3.5 (semver) Affected: 3.2.0 , < 3.2.6 (semver) Affected: 3.0.0 , < 3.0.18 (semver) Affected: 1.1.1 , < 1.1.1zd (custom) Affected: 1.0.2 , < 1.0.2zm (custom)
Siemens	RUGGEDCOM RST2428P	Affected: 0 , < V3.3 (custom)
Siemens	RUGGEDCOM RST2428P	Affected: 0 , < V4.0 (custom)
Siemens	SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XCH328	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XCM324	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XCM328	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XCM332	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XRH334 (24 V DC, 8xFO, CC)	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XRM334 (230 V AC, 12xFO)	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XRM334 (230 V AC, 8xFO)	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+)	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XRM334 (24 V DC, 12xFO)	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XRM334 (24 V DC, 8xFO)	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+)	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XRM334 (2x230 V AC, 12xFO)	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XRM334 (2x230 V AC, 8xFO)	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+)	Affected: 0 , < V3.3 (custom)
Siemens	SIDIS Prime	Affected: 0 , < V4.0.800 (custom)
Siemens	SIDIS Secured SmartPlug	Affected: 0 , < V7.26.0310 (custom)
Siemens	SIMATIC CN 4100	Affected: 0 , < V5.0 (custom)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.5 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	Affected: V3.1.5 , < * (custom)
Siemens	SIMATIC S7-1500 TM MFP - GNU/Linux subsystem	Affected: 0 , < V1.1.1 (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.5 , < * (custom)

Date Public

2025-09-30 14:00

Credits

Stanislav Fort (Aisle Research) Stanislav Fort (Aisle Research) Viktor Dukhovni

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-9230",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-30T19:30:08.302408Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-30T19:30:29.803Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T21:15:17.295Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00001.html"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/09/30/5"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM RST2428P",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM RST2428P",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XCH328",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XCM324",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XCM328",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XCM332",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRH334 (24 V DC, 8xFO, CC)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (230 V AC, 12xFO)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (230 V AC, 8xFO)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (24 V DC, 12xFO)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (24 V DC, 8xFO)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (2x230 V AC, 12xFO)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (2x230 V AC, 8xFO)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIDIS Prime",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.0.800",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIDIS Secured SmartPlug",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V7.26.0310",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC CN 4100",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V1.1.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T01:02:22.327Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-089022.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-485750.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-585531.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenSSL",
          "vendor": "OpenSSL",
          "versions": [
            {
              "lessThan": "3.5.4",
              "status": "affected",
              "version": "3.5.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.4.3",
              "status": "affected",
              "version": "3.4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.3.5",
              "status": "affected",
              "version": "3.3.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.2.6",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.0.18",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.1.1zd",
              "status": "affected",
              "version": "1.1.1",
              "versionType": "custom"
            },
            {
              "lessThan": "1.0.2zm",
              "status": "affected",
              "version": "1.0.2",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Stanislav Fort (Aisle Research)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Stanislav Fort (Aisle Research)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Viktor Dukhovni"
        }
      ],
      "datePublic": "2025-09-30T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Issue summary: An application trying to decrypt CMS messages encrypted using\u003cbr\u003epassword based encryption can trigger an out-of-bounds read and write.\u003cbr\u003e\u003cbr\u003eImpact summary: This out-of-bounds read may trigger a crash which leads to\u003cbr\u003eDenial of Service for an application. The out-of-bounds write can cause\u003cbr\u003ea memory corruption which can have various consequences including\u003cbr\u003ea Denial of Service or Execution of attacker-supplied code.\u003cbr\u003e\u003cbr\u003eAlthough the consequences of a successful exploit of this vulnerability\u003cbr\u003ecould be severe, the probability that the attacker would be able to\u003cbr\u003eperform it is low. Besides, password based (PWRI) encryption support in CMS\u003cbr\u003emessages is very rarely used. For that reason the issue was assessed as\u003cbr\u003eModerate severity according to our Security Policy.\u003cbr\u003e\u003cbr\u003eThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\u003cbr\u003eissue, as the CMS implementation is outside the OpenSSL FIPS module\u003cbr\u003eboundary."
            }
          ],
          "value": "Issue summary: An application trying to decrypt CMS messages encrypted using\npassword based encryption can trigger an out-of-bounds read and write.\n\nImpact summary: This out-of-bounds read may trigger a crash which leads to\nDenial of Service for an application. The out-of-bounds write can cause\na memory corruption which can have various consequences including\na Denial of Service or Execution of attacker-supplied code.\n\nAlthough the consequences of a successful exploit of this vulnerability\ncould be severe, the probability that the attacker would be able to\nperform it is low. Besides, password based (PWRI) encryption support in CMS\nmessages is very rarely used. For that reason the issue was assessed as\nModerate severity according to our Security Policy.\n\nThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\nissue, as the CMS implementation is outside the OpenSSL FIPS module\nboundary."
        }
      ],
      "metrics": [
        {
          "format": "other",
          "other": {
            "content": {
              "text": "Moderate"
            },
            "type": "https://openssl-library.org/policies/general/security-policy/"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125 Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-787",
              "description": "CWE-787 Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-30T13:17:00.808Z",
        "orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
        "shortName": "openssl"
      },
      "references": [
        {
          "name": "OpenSSL Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://openssl-library.org/news/secadv/20250930.txt"
        },
        {
          "name": "3.5.4 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/bae259a211ada6315dc50900686daaaaaa55f482"
        },
        {
          "name": "3.4.3 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/9e91358f365dee6c446dcdcdb01c04d2743fd280"
        },
        {
          "name": "3.3.5 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/5965ea5dd6960f36d8b7f74f8eac67a8eb8f2b45"
        },
        {
          "name": "3.2.6 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/b5282d677551afda7d20e9c00e09561b547b2dfd"
        },
        {
          "name": "3.0.18 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/a79c4ce559c6a3a8fd4109e9f33c1185d5bf2def"
        },
        {
          "name": "1.1.1zd git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.openssl.org/openssl/extended-releases/commit/dfbaf161d8dafc1132dd88cd48ad990ed9b4c8ba"
        },
        {
          "name": "1.0.2zm git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.openssl.org/openssl/extended-releases/commit/c2b96348bfa662f25f4fabf81958ae822063dae3"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Out-of-bounds read \u0026 write in RFC 3211 KEK Unwrap",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
    "assignerShortName": "openssl",
    "cveId": "CVE-2025-9230",
    "datePublished": "2025-09-30T13:17:00.808Z",
    "dateReserved": "2025-08-20T08:38:07.678Z",
    "dateUpdated": "2026-10-15T01:02:22.327Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted