OpenSSL Security Advisory – Critical Vulnerabilities Fixed

OpenSSL has released a critical security advisory to address several vulnerabilities in versions 3.6 to 3.0. These vulnerabilities, including buffer overflows and NULL pointer dereference issues, can lead to remote code execution (RCE) and Denial of Service (DoS) under specific conditions.

Vulnerabilities in Detail

The advisory highlights three significant vulnerabilities that could impact OpenSSL users, especially those running outdated versions. The flaws are tied to core functions such as file parsing, cipher management, and SSL/TLS handling, and they could allow attackers to gain control of affected systems.

1. CVE-2025-11187: Stack Buffer Overflow in PKCS#12 Parsing

This vulnerability arises in the processing of PKCS#12 files, specifically during the validation of PBMAC1 parameters. A malformed PKCS#12 file could cause a stack buffer overflow or NULL pointer dereference, which could crash the application or lead to arbitrary code execution in a non-fortified environment.

2. CVE-2025-15467: Stack Buffer Overflow in CMS Parsing

This vulnerability exists in the CMS (Cryptographic Message Syntax) processing, particularly when handling AuthEnvelopedData. By sending malicious CMS messages with oversized IVs, attackers could trigger a stack buffer overflow, leading to Denial of Service (DoS) or even potential RCE under specific conditions.

3. CVE-2025-15468: NULL Pointer Dereference in QUIC

In the QUIC protocol implementation, a NULL pointer dereference occurs when the SSL_CIPHER_find() function encounters unsupported cipher IDs. This leads to application crashes, resulting in DoS.

Impact and Resolution

Users of OpenSSL versions 3.6, 3.5, 3.4, and 3.3 should immediately upgrade to version 3.6.1 or later to mitigate these issues. Users running OpenSSL 3.0 or 1.1.1 are not affected by the vulnerabilities discussed in this advisory. However, the OpenSSL team strongly recommends keeping all systems up to date with the latest patches to ensure overall security.

IoC Table

Conclusion

This OpenSSL security advisory emphasizes the need for urgent patches for systems running versions 3.6 to 3.0. The vulnerabilities pose a serious risk of remote code execution and Denial of Service, which could impact the integrity of systems using OpenSSL for cryptographic operations. To prevent potential exploits, OpenSSL users must upgrade to version 3.6.1 or higher as soon as possible.

Source: OpenSSL Advisory on Vulnerabilities