CVE-2025-9230: Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can tri

This month

HIGH 7.5REMOTEWATCHLIST

CVE-2025-9230 is a high-severity flaw (CVSS 7.5) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application. The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service or Execution of attacker-supplied code. Although the consequences o

Why this priority

High severity
Remotely exploitable, no login, no user action
On your watchlist

A fixed release or distro patch exists.

Risk facts

CVSS score	7.5 (High)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	1.6% (top 25%)
CISA exploited list	No
Weakness	CWE-125, CWE-787
Published	2025-09-30
Last modified	2026-10-15

Publisher (CNA): OpenSSL Software Foundation

Last updated 2026-10-15 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Timeline

2025-09-30 14:15 UTCPublished CVE record published
2026-10-15 02:18 UTCUpdated Record last modified

Exact fixes by distribution

Fedora 46 · pipx · FIXED · 1.18.9-1.fc46 · FEDORA-2026-95305954ab · source

sudo dnf upgrade --advisory=FEDORA-2026-95305954ab

Fedora ELN · libisds · FIXED · 0.11.2-19.eln159 · FEDORA-2026-bf61b68668 · source

sudo dnf upgrade --advisory=FEDORA-2026-bf61b68668

Debian 12 · openssl · FIXED · 3.0.17-1~deb12u3

sudo apt update && sudo apt install --only-upgrade openssl dpkg --compare-versions "$(dpkg-query -W -f='${Version}' openssl)" ge "3.0.17-1~deb12u3" && echo PATCHED || echo STILL-VULNERABLE

Debian 13 · openssl · FIXED · 3.5.1-1+deb13u1

sudo apt update && sudo apt install --only-upgrade openssl dpkg --compare-versions "$(dpkg-query -W -f='${Version}' openssl)" ge "3.5.1-1+deb13u1" && echo PATCHED || echo STILL-VULNERABLE

RHEL 10 · openssl · FIXED · openssl-3.5.1-4.el10_1

sudo dnf upgrade --advisory=RHSA-2025:21248 rpm -q openssl

RHEL 10 · edk2 · FIXED · edk2-20250822-4.el10

sudo dnf upgrade --advisory=RHSA-2026:18320 rpm -q edk2

RHEL 10.0 Extended Update Support · openssl · FIXED · openssl-3.2.2-16.el10_0.5

sudo dnf upgrade --advisory=RHSA-2025:22794 rpm -q openssl

RHEL 10.0 Extended Update Support · edk2 · FIXED · edk2-20241117-2.el10_0.2

sudo dnf upgrade --advisory=RHSA-2026:65132 rpm -q edk2

RHEL 7 Extended Lifecycle Support · openssl · FIXED · openssl-1.0.2k-26.el7_9.1

sudo dnf upgrade --advisory=RHSA-2026:1720 rpm -q openssl

Alpine 3.20 · openssl · FIXED · openssl-3.3.5-r0

apk add --upgrade openssl apk info -v openssl

Alpine 3.21 · openssl · FIXED · openssl-3.3.5-r0

apk add --upgrade openssl apk info -v openssl

Alpine 3.22 · openssl · FIXED · openssl-3.5.4-r0

apk add --upgrade openssl apk info -v openssl

Alpine 3.22 · libressl · FIXED · libressl-4.1.1-r0

apk add --upgrade libressl apk info -v libressl

Amazon Linux 2023 · see advisory · FIXED · ALAS2023-2025-1225 · source

sudo dnf update --advisory=ALAS2023-2025-1225

Amazon Linux 2 · see advisory · FIXED · ALAS2-2025-3104 · source

sudo yum update --advisory=ALAS2-2025-3104

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

Write-up: cert-portal.siemens.com/productcert/html/ssa-082556.html
Write-up: cert-portal.siemens.com/productcert/html/ssa-253495.html
Write-up: cert-portal.siemens.com/productcert/html/ssa-265688.html

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2025-9230?

No fixed release is listed yet. Watch the vendor advisory and apply any mitigation shown on this page.

Is CVE-2025-9230 being exploited?

CVE-2025-9230 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2025-9230 affect?

CVE-2025-9230 affects affected software. Severity is high (CVSS 7.5). Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Servic

How urgent is CVE-2025-9230?

Priority 55/100. High severity; Remotely exploitable, no login, no user action; On your watchlist

References

← Back to latest CVEs