Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2025-35471: conda-forge openssl-feedstock before 066e83c (2024-05-20), on Microsoft Windows, configures OpenSSL to use an

39
Routine
HIGH 7.3WATCHLISTUPGRADEUPGRADE

CVE-2025-35471 is a high-severity flaw (CVSS 7.3) affecting miniforge, openssl-feedstock. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

conda-forge openssl-feedstock before 066e83c (2024-05-20), on Microsoft Windows, configures OpenSSL to use an OPENSSLDIR file path that can be written to by non-privilged local users. By writing a specially crafted openssl.cnf file in OPENSSLDIR, a non-privileged local user can execute arbitrary code with the privileges of the user or process loading openssl-feedstock DLLs. Miniforge before 24.5.0 is also affected.

Why this priority

  • High severity
  • Public exploit reference
  • On your watchlist

A fixed release or distro patch exists.

Risk facts

CVSS score7.3 (High)
Attack vectorLocal
Attack complexityLow
Privileges neededLow
User interactionRequired
EPSS exploit chance0.2% (top 86%)
CISA exploited listNo
WeaknessCWE-427
Published2025-05-13
Last modified2026-06-17
Publisher (CNA): Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government · Vendor: conda-forge

Share: LinkedIn · X · Reddit

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

conda-forge miniforge UPGRADE
Affected: < 24.5.0
Fixed in: 24.5.0
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy miniforge || rpm -q miniforge || miniforge --version
2. UPGRADE to 24.5.0 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade miniforge
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade miniforge
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
conda-forge openssl-feedstock UPGRADE
Affected: < 2024-05-20
Fixed in: 2024-05-20
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy openssl-feedstock || rpm -q openssl-feedstock || openssl-feedstock --version
2. UPGRADE to 2024-05-20 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade openssl-feedstock
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade openssl-feedstock
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2025-35471?

miniforge: upgrade to 24.5.0; openssl-feedstock: upgrade to 2024-05-20. Exact commands for each OS are on this page.

Is CVE-2025-35471 being exploited?

CVE-2025-35471 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2025-35471 affect?

CVE-2025-35471 affects miniforge, openssl-feedstock. Severity is high (CVSS 7.3). conda-forge openssl-feedstock before 066e83c (2024-05-20), on Microsoft Windows, configures OpenSSL to use an OPENSSLDIR file path that can be written to by non-privilged local users. By writing a specially crafted openssl.cnf file in OPENS

How urgent is CVE-2025-35471?

Priority 39/100. High severity; Public exploit reference; On your watchlist

Software pages

OpenSSL vulnerabilities · Windows vulnerabilities

References

← Back to latest CVEs

Get the weekly exploited-CVE digest by emailThe CVEs being attacked this week and how to fix them. No spam, unsubscribe any time.