CVE-2025-9230
BaseFortify
Publication date: 2025-09-30
Last updated on: 2025-11-04
Assigner: OpenSSL Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| openssl | openssl | 1.1.1 |
| openssl | openssl | 3.4 |
| openssl | openssl | 3.5 |
| openssl | openssl | 1.0.2 |
| openssl | openssl | 3.2 |
| openssl | openssl | 3.3 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-9230 is a vulnerability in OpenSSL's CMS message decryption process when using password based encryption. It involves an incorrect size check in the function `kek_unwrap_key()`, which is off by 8 bytes. This flaw allows an attacker to read beyond the intended memory boundary by up to 8 bytes and overwrite up to 4 bytes of memory. This out-of-bounds read and write can cause memory corruption, potentially leading to application crashes or execution of attacker-supplied code. [1, 2, 3, 4, 6]
How can this vulnerability impact me? :
The vulnerability can cause an application to crash, resulting in a Denial of Service (DoS). More severely, the memory corruption caused by the out-of-bounds write could allow an attacker to execute arbitrary code within the affected application. However, the likelihood of a successful exploit is considered low, and the affected feature (password based encryption in CMS messages) is rarely used.
What immediate steps should I take to mitigate this vulnerability?
To mitigate CVE-2025-9230, you should update OpenSSL to a version that includes the fix for the incorrect size check in the `kek_unwrap_key()` function. The vulnerability is addressed by patches that correct the off-by-8-bytes error in size validation, preventing memory overread and overwrite issues. Applying the latest security updates or patches from OpenSSL that contain this fix is the recommended immediate step. [1, 2, 3, 4, 6]