CVE advisoryCRITICAL
CVE-2025-9230
OpenSSL CMS Password-Based Encryption Out-of-Bounds Read Write
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
An application's ability to decrypt CMS messages using password-based encryption is vulnerable to an out-of-bounds read and write, potentially causing denial of service or attacker code execution. However, the specific encryption method is rarely used, making exploitation unlikely, and FIPS modules are not affected.