Intel

CVE-2025-15467

Red Hat Security Advisory: Red Hat AI Inference Server 3.2.2 (CUDA)

highEPSS 48%

Description

Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote code execution. When parsing CMS (Auth)EnvelopedData structures that use AEAD ciphers such as AES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is copied into a fixed-size stack buffer without verifying that its length fits the destination. An attacker can supply a crafted CMS message with an oversized IV, causing a stack-based out-of-bounds write before any authentication or tag verification occurs. Applications and services that parse untrusted CMS or PKCS#7 content using AEAD ciphers (e.g., S/MIME (Auth)EnvelopedData with AES-GCM) are vulnerable. Because the overflow occurs prior to authentication, no valid key material is required to trigger it. While exploitability to remote code execution depends on platform and toolchain mitigations, the stack-based write primitive represents a severe risk. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue. OpenSSL 1.1.1 and 1.0.2 are not affected by this issue.

Source: BSIBSI_CSAFBSIBSI_CSAFREDHAT_CSAFREDHAT_CSAFBSIBSI_CSAFBSIBSI_CSAFBSI_CSAFBSIREDHAT_CSAFREDHAT_CSAFREDHAT_CSAFREDHAT_CSAFREDHAT_CSAFREDHAT_CSAFSIEMENS_ADVISORYCVELISTV5SIEMENS_ADVISORYNVDCVEORGDEBIAN_DSA

Metrics

Severity
high
Priority score
225.36
KEV status
—
Exploit maturity
no public PoC known
XIEM Effective CVSS
8.8
Source: nvd-v3
CVSS v3
8.8
CVSS v4
—
EPSS percentile
98.8 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
48.2 %
Elevated — model estimates 10-50% exploitation likelihood.
Published
2026-02-27 14:54 UTC
CWE
CWE-787

Weakness classes (CWE)

  • CWE-787Base

    Out-of-bounds Write

    The product writes data past the end, or before the beginning, of the intended buffer.

    cwe.mitre.org →

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. CVE Modified2026-09-07 13:17 UTC· af854a3a-2127-422b-91ae-364da2661108
    • Reference: http://www.openwall.com/lists/oss-security/2026/01/27/10
    • Reference: http://www.openwall.com/lists/oss-security/2026/02/25/6
    • Reference: http://www.openwall.com/lists/oss-security/2026/01/27/10
    • Reference: http://www.openwall.com/lists/oss-security/2026/02/25/6
  2. CVE Modified2026-09-07 13:17 UTC· 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
    • Affected: Affected value modified. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2025/15xxx/CVE-2025-15467.json">CVE-2025-15467</a>
    • Reference: https://access.redhat.com/errata/RHSA-2026:1472
    • Reference: https://access.redhat.com/errata/RHSA-2026:1473
    • Reference: https://access.redhat.com/errata/RHSA-2026:1496
  3. CVE Modified2026-09-07 13:17 UTC· openssl-security@openssl.org
    • Reference: https://github.com/openssl/openssl/commit/2c8f0e5fa9b6ee5508a0349e4572ddb74db5a703
    • Reference: https://github.com/openssl/openssl/commit/5f26d4202f5b89664c5c3f3c62086276026ba9a9
    • Reference: https://github.com/openssl/openssl/commit/6ced0fe6b10faa560e410e3ee8d6c82f06c65ea3
    • Reference: https://github.com/openssl/openssl/commit/ce39170276daec87f55c39dad1f629b56344429e
  4. CVE Modified2026-09-07 13:17 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
    • Reference: https://github.com/guiimoraes/CVE-2025-15467
    • Reference: https://github.com/guiimoraes/CVE-2025-15467
    • Reference Type: https://github.com/guiimoraes/CVE-2025-15467 Types: Exploit, Third Party Advisory
  5. CVE Modified2026-09-07 13:17 UTC· 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
    • Reference: https://cert-portal.siemens.com/productcert/html/ssa-434797.html
    • Reference: https://cert-portal.siemens.com/productcert/html/ssa-734552.html
    • Reference: https://cert-portal.siemens.com/productcert/html/ssa-434797.html
    • Reference: https://cert-portal.siemens.com/productcert/html/ssa-734552.html

Affected operating systems

  • linux

    redhat / enterprise_linux10.0

  • linux

    redhat / enterprise_linux8.0

  • linux

    redhat / enterprise_linux9.0

  • linux

    ubuntu / gdaltrusty

  • linux

    ubuntu / gdalxenial

  • linux

    ubuntu / golang-go.cryptobionic

  • linux

    ubuntu / golang-go.cryptofocal

  • linux

    ubuntu / golang-go.cryptojammy

  • linux

    ubuntu / golang-go.cryptonoble

  • linux

    ubuntu / golang-go.cryptoquesting

  • linux

    ubuntu / golang-go.cryptoxenial

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • aiohttp

    aiohttp3.13.3

  • anyscale

    ray2.52.0

  • bitnami

    golang1.24.0

  • bitnami

    sqlite

  • Dell

    Secure Connect GatewayAppliance 5.32.00.18

  • go

    github.com/opencontainers/runc1.0.0-rc3

  • go

    github.com/opencontainers/runc1.3.0-rc.1

  • go

    github.com/opencontainers/runc1.4.0-rc.1

  • go

    github.com/sigstore/fulcio

  • go

    golang.org/x/oauth2

  • google

    protobuf33.4

  • IBM

    AIX7.2

  • IBM

    AIX7.3

  • IBM

    Concert< 3.0.0

    fixed in 3.0.0

  • IBM

    DevOps Code ClearCase10.0.1.05

  • IBM

    DevOps Code ClearCase11.0.0.05

  • IBM

    DevOps Code ClearCase9.1.0.10

  • IBM

    MQContainer

  • IBM

    MQOperator

  • IBM

    TXSeriesfor multiplatforms

  • IBM

    VIOS3.1

  • IBM

    VIOS4.1

  • IGEL

    OS11.11.100

  • IGEL

    OS12.7.4

References & sources

Linked CVEs

Show 15 more CVEs
IDCVE-2025-15467