CVE-2025-9230: openssl Out-of-bounds Read

CVSS: 7.5v3.1HighDeferred

AliasesALPINE-CVE-2025-9230MGASA-2025-0244SUSE-SU-2025:03437-1+55 more

Published 30-09-2025Last modified 15-10-2026

Vulnerability summary

CVE-2025-9230 is a high (CVSS 7.5) Out-of-bounds Read vulnerability in openssl. EPSS estimates a 1.55% chance of exploitation in the next 30 days, higher than 74.8% of scored vulnerabilities.

Overall risk

30/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.5/10

010

High · v3.1 (CVE.org)

EPSS score

1.55%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 17 · Related 11

DSA-6015-1 MGASA-2025-0241 OPENSUSE-SU-2025:15723-1 OPENSUSE-SU-2025:20164-1 OPENSUSE-SU-2026:10237-1 RHSA-2026:2994+12 more

Timeline

30-09-2025
PublishedVulnerability first disclosed.
15-10-2026
Last modifiedVulnerability information updated.

Description

Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application. The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service or Execution of attacker-supplied code. Although the consequences of a successful exploit of this vulnerability could be severe, the probability that the attacker would be able to perform it is low. Besides, password based (PWRI) encryption support in CMS messages is very rarely used. For that reason the issue was assessed as Moderate severity according to our Security Policy. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary.

CVSS metrics

8 scores · 8 sources · 1 version

v3.17.5

EPSS trend

Probability

1.55%

Chance of exploitation in the next 30 days

Percentile

75%

Versus all other CVEs

30-day change

0.00 pp

From 1.55% on 20-09-2026

20-09-202620-10-2026

EPSS score

1.55%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Redhat182 products

ansible-collection-redhat-satellite< 0:5.10.0-1.el9sat
ansible-collection-redhat-satellite_operations< 0:3.0.1-1.el9sat
ansible-core< 1:2.16.14-3.el9sat
ansible-lint< 0:5.4.0-2.el9pc
ansible-runner< 0:2.3.6-2.el9sat

ansible-test< 1:2.16.14-3.el9sat
ansiblerole-foreman_scap_client< 0:0.5.0-1.el9sat
ansiblerole-insights-client< 0:1.7.1-3.el9sat
candlepin< 0:4.7.4-1.el9sat
candlepin-selinux< 0:4.7.4-1.el9sat
cjson< 0:1.7.18-2.el9sat
cjson-debuginfo< 0:1.7.18-2.el9sat
cjson-debugsource< 0:1.7.18-2.el9sat
createrepo_c< 0:1.2.1-2.el9pc
createrepo_c-debuginfo< 0:1.2.1-2.el9pc
createrepo_c-debugsource< 0:1.2.1-2.el9pc
createrepo_c-libs< 0:1.2.1-2.el9pc
createrepo_c-libs-debuginfo< 0:1.2.1-2.el9pc
dynflow-utils< 0:1.6.3-2.el9sat
edk2< 0:20250822-4.el10 | < 0:20241117-2.el9_6.2 | < 0:20241117-4.el9_7.3 | < 0:20231122-6.el9_4.10 | < 0:20220126gitbb1bba3d77-4.el8_8.8 | < 0:20220126gitbb1bba3d77-13.el8_10.10 | < 0:20241117-2.el10_0.2
edk2-aarch64< 0:20250822-4.el10 | < 0:20241117-2.el9_6.2 | < 0:20241117-4.el9_7.3 | < 0:20231122-6.el9_4.10 | < 0:20220126gitbb1bba3d77-13.el8_10.10 | < 0:20241117-2.el10_0.2
edk2-debugsource< 0:20250822-4.el10 | < 0:20241117-2.el9_6.2 | < 0:20241117-4.el9_7.3 | < 0:20231122-6.el9_4.10 | < 0:20241117-2.el10_0.2
edk2-ovmf< 0:20250822-4.el10 | < 0:20241117-2.el9_6.2 | < 0:20241117-4.el9_7.3 | < 0:20231122-6.el9_4.10 | < 0:20220126gitbb1bba3d77-4.el8_8.8 | < 0:20220126gitbb1bba3d77-13.el8_10.10 | < 0:20241117-2.el10_0.2
edk2-tools< 0:20250822-4.el10 | < 0:20241117-2.el9_6.2 | < 0:20241117-4.el9_7.3 | < 0:20231122-6.el9_4.10 | < 0:20241117-2.el10_0.2
edk2-tools-debuginfo< 0:20250822-4.el10 | < 0:20241117-2.el9_6.2 | < 0:20241117-4.el9_7.3 | < 0:20231122-6.el9_4.10 | < 0:20241117-2.el10_0.2
edk2-tools-doc< 0:20250822-4.el10 | < 0:20241117-2.el9_6.2 | < 0:20241117-4.el9_7.3 | < 0:20231122-6.el9_4.10 | < 0:20241117-2.el10_0.2
foreman< 0:3.18.0.3-3.el9sat
foreman-bootloaders-redhat< 0:202506020000-2.el9sat
foreman-bootloaders-redhat-tftpboot< 0:202506020000-2.el9sat
foreman-cli< 0:3.18.0.3-3.el9sat
foreman-debug< 0:3.18.0.3-3.el9sat
foreman-discovery-image< 1:5.1.4-10.el9sat
foreman-discovery-image-service< 0:1.0.0-5.el9sat
foreman-discovery-image-service-tui< 0:1.0.0-5.el9sat
foreman-dynflow-sidekiq< 0:3.18.0.3-3.el9sat
foreman-ec2< 0:3.18.0.3-3.el9sat
foreman-fapolicyd< 0:1.1.0-1.el9sat
foreman-installer< 1:3.18.0.1-1.el9sat
foreman-installer-katello< 1:3.18.0.1-1.el9sat
foreman-journald< 0:3.18.0.3-3.el9sat
foreman-libvirt< 0:3.18.0.3-3.el9sat
foreman-obsolete-packages< 0:1.11-1.el9sat
foreman-openstack< 0:3.18.0.3-3.el9sat
foreman-pcp< 0:3.18.0.3-3.el9sat
foreman-postgresql< 0:3.18.0.3-3.el9sat
foreman-proxy< 0:3.18.0-1.el9sat
foreman-proxy-content< 0:4.20.0-1.el9sat
foreman-proxy-fapolicyd< 0:1.1.0-1.el9sat
foreman-proxy-journald< 0:3.18.0-1.el9sat
foreman-redis< 0:3.18.0.3-3.el9sat
foreman-selinux< 0:3.18.0-1.el9sat
foreman-service< 0:3.18.0.3-3.el9sat
foreman-telemetry< 0:3.18.0.3-3.el9sat
foreman-vmware< 0:3.18.0.3-3.el9sat
katello< 0:4.20.0-1.el9sat
katello-certs-tools< 0:2.10.0-1.el9sat
katello-client-bootstrap< 0:1.7.9-2.el9sat
katello-common< 0:4.20.0-1.el9sat
katello-debug< 0:4.20.0-1.el9sat
katello-selinux< 0:5.2.0-1.el9sat
libcomps< 0:0.1.23-1.el9pc
libcomps-debuginfo< 0:0.1.23-1.el9pc
libcomps-debugsource< 0:0.1.23-1.el9pc
libsodium< 0:1.0.17-3.el9sat
libsodium-debuginfo< 0:1.0.17-3.el9sat
libsodium-debugsource< 0:1.0.17-3.el9sat
mosquitto< 0:2.0.19-1.el9sat
mosquitto-debuginfo< 0:2.0.19-1.el9sat
mosquitto-debugsource< 0:2.0.19-1.el9sat
openssl< 1:3.2.2-7.el9_6.1 | < 1:3.5.1-4.el10_1 | < 1:3.5.1-4.el9_7 | < 1:3.0.7-29.el9_4.1 | < 1:3.2.2-16.el10_0.5 | < 1:1.1.1k-14.el8_10 | < 1:1.1.1k-14.el8_8.1 | < 1:1.1.1k-14.el8_6.1 | < 1:3.0.7-18.el9_2.2 | < 1:1.1.1c-21.el8_2.1 | < 1:3.0.1-46.el9_0.6 | < 1:1.1.1g-18.el8_4.1 | < 1:1.0.2k-26.el7_9.1
openssl-debuginfo< 1:3.2.2-7.el9_6.1 | < 1:3.5.1-4.el10_1 | < 1:3.5.1-4.el9_7 | < 1:3.0.7-29.el9_4.1 | < 1:3.2.2-16.el10_0.5 | < 1:1.1.1k-14.el8_10 | < 1:1.1.1k-14.el8_8.1 | < 1:1.1.1k-14.el8_6.1 | < 1:1.1.1c-21.el8_2.1 | < 1:1.1.1g-18.el8_4.1 | < 1:1.0.2k-26.el7_9.1
openssl-debugsource< 1:3.2.2-7.el9_6.1 | < 1:3.5.1-4.el10_1 | < 1:3.5.1-4.el9_7 | < 1:3.0.7-29.el9_4.1 | < 1:3.2.2-16.el10_0.5 | < 1:1.1.1k-14.el8_10 | < 1:1.1.1k-14.el8_8.1 | < 1:1.1.1k-14.el8_6.1 | < 1:1.1.1c-21.el8_2.1 | < 1:1.1.1g-18.el8_4.1
openssl-devel< 1:3.2.2-7.el9_6.1 | < 1:3.5.1-4.el10_1 | < 1:3.5.1-4.el9_7 | < 1:3.0.7-29.el9_4.1 | < 1:3.2.2-16.el10_0.5 | < 1:1.1.1k-14.el8_10 | < 1:1.1.1k-14.el8_8.1 | < 1:1.1.1k-14.el8_6.1 | < 1:3.0.7-18.el9_2.2 | < 1:1.1.1c-21.el8_2.1 | < 1:3.0.1-46.el9_0.6 | < 1:1.1.1g-18.el8_4.1 | < 1:1.0.2k-26.el7_9.1
openssl-fips-provider< 0:3.0.7-1.el9_2.1 | < 0:3.0.7-1.el9_0.1
openssl-fips-provider-so< 0:3.0.7-1.el9_2.1 | < 0:3.0.7-1.el9_0.1
openssl-libs< 1:3.2.2-7.el9_6.1 | < 1:3.5.1-4.el10_1 | < 1:3.5.1-4.el9_7 | < 1:3.0.7-29.el9_4.1 | < 1:3.2.2-16.el10_0.5 | < 1:1.1.1k-14.el8_10 | < 1:1.1.1k-14.el8_8.1 | < 1:1.1.1k-14.el8_6.1 | < 1:3.0.7-18.el9_2.2 | < 1:1.1.1c-21.el8_2.1 | < 1:3.0.1-46.el9_0.6 | < 1:1.1.1g-18.el8_4.1 | < 1:1.0.2k-26.el7_9.1
openssl-libs-debuginfo< 1:3.2.2-7.el9_6.1 | < 1:3.5.1-4.el10_1 | < 1:3.5.1-4.el9_7 | < 1:3.0.7-29.el9_4.1 | < 1:3.2.2-16.el10_0.5 | < 1:1.1.1k-14.el8_10 | < 1:1.1.1k-14.el8_8.1 | < 1:1.1.1k-14.el8_6.1 | < 1:1.1.1c-21.el8_2.1 | < 1:3.0.1-46.el9_0.6 | < 1:1.1.1g-18.el8_4.1
openssl-perl< 1:3.2.2-7.el9_6.1 | < 1:3.5.1-4.el10_1 | < 1:3.5.1-4.el9_7 | < 1:3.0.7-29.el9_4.1 | < 1:3.2.2-16.el10_0.5 | < 1:1.1.1k-14.el8_10 | < 1:1.1.1k-14.el8_8.1 | < 1:1.1.1k-14.el8_6.1 | < 1:3.0.7-18.el9_2.2 | < 1:1.1.1c-21.el8_2.1 | < 1:3.0.1-46.el9_0.6 | < 1:1.1.1g-18.el8_4.1 | < 1:1.0.2k-26.el7_9.1
openssl-static< 1:1.0.2k-26.el7_9.1
openvox-agent< 0:8.24.1-1.el9sat
openvox-server< 0:8.12.1-1.el9sat
pulpcore-obsolete-packages< 0:1.3.0-1.el9pc
pulpcore-selinux< 0:2.2.0-1.el9pc
puppet-agent-oauth< 0:0.5.10-2.el9sat
puppet-foreman_scap_client< 0:1.0.0-2.el9sat
puppetlabs-stdlib< 0:9.4.1-1.el9sat
python-websockify< 0:0.10.0-3.el9sat
python3-libcomps< 0:0.1.23-1.el9pc
python3-libcomps-debuginfo< 0:0.1.23-1.el9pc
python3-websockify< 0:0.10.0-3.el9sat
python3.12-aiodns< 0:3.5.0-1.el9pc
python3.12-aiofiles< 0:24.1.0-2.el9pc
python3.12-aiohappyeyeballs< 0:2.6.1-1.el9pc
python3.12-aiohttp< 0:3.13.3-1.el9pc
python3.12-aiohttp-debuginfo< 0:3.13.3-1.el9pc
python3.12-aiohttp-debugsource< 0:3.13.3-1.el9pc
python3.12-aiohttp-xmlrpc< 0:1.5.0-7.el9pc
python3.12-aiosignal< 0:1.4.0-1.el9pc
python3.12-ansible-builder< 0:3.0.0-3.el9pc
python3.12-ansible-runner< 0:2.3.6-2.el9sat
python3.12-asgiref< 0:3.9.1-1.el9pc
python3.12-async-lru< 0:2.0.4-2.el9pc
python3.12-asyncio-throttle< 0:1.0.2-8.el9pc
python3.12-attrs< 0:22.2.0-2.el9pc
python3.12-backoff< 0:2.2.1-6.el9pc
python3.12-bindep< 0:2.13.0-1.el9pc
python3.12-bleach< 0:3.3.1-7.el9pc
python3.12-bleach-allowlist< 0:1.0.3-8.el9pc
python3.12-bracex< 0:2.6-1.el9pc
python3.12-brotli< 0:1.2.0-1.el9pc
python3.12-brotli-debuginfo< 0:1.2.0-1.el9pc
python3.12-brotli-debugsource< 0:1.2.0-1.el9pc
python3.12-certifi< 0:2026.1.4-1.el9pc
python3.12-cffi< 0:2.0.0-1.el9pc
python3.12-cffi-debuginfo< 0:2.0.0-1.el9pc
python3.12-cffi-debugsource< 0:2.0.0-1.el9pc
python3.12-chardet< 0:5.2.0-1.el9pc
python3.12-charset-normalizer< 0:3.4.2-1.el9pc
python3.12-click< 0:8.1.7-2.el9pc
python3.12-createrepo_c< 0:1.2.1-2.el9pc
python3.12-createrepo_c-debuginfo< 0:1.2.1-2.el9pc
python3.12-cryptography< 0:46.0.6-1.el9pc
python3.12-daemon< 0:2.3.1-5.el9sat
python3.12-dateutil< 0:2.8.2-8.el9pc
python3.12-debian< 0:0.1.49-2.el9pc
python3.12-defusedxml< 0:0.7.1-8.el9pc
python3.12-deprecated< 0:1.2.18-2.el9pc
python3.12-diff-match-patch< 0:20241021-2.el9pc
python3.12-distro< 0:1.7.0-7.el9pc
python3.12-django< 0:4.2.30-1.el9pc
python3.12-django-filter< 0:25.1-1.el9pc
python3.12-django-guid< 0:3.5.2-1.el9pc
python3.12-django-import-export< 0:3.3.9-3.el9pc
python3.12-django-lifecycle< 0:1.2.4-3.el9pc
python3.12-django-readonly-field< 0:1.1.2-6.el9pc
python3.12-djangorestframework< 0:3.15.2-3.el9pc
python3.12-djangorestframework-queryfields< 0:1.1.0-3.el9pc
python3.12-docutils< 0:0.19-3.el9sat
python3.12-drf-access-policy< 0:1.5.0-3.el9pc
python3.12-drf-nested-routers< 0:0.94.1-3.el9pc
python3.12-drf-spectacular< 0:0.27.2-3.el9pc
python3.12-dynaconf< 0:3.2.12-1.el9pc
python3.12-enrich< 0:1.2.6-11.el9pc
python3.12-et-xmlfile< 0:2.0.0-1.el9pc
python3.12-flake8< 0:6.1.0-3.el9pc
python3.12-frozenlist< 0:1.5.0-2.el9pc
python3.12-frozenlist-debuginfo< 0:1.5.0-2.el9pc
python3.12-frozenlist-debugsource< 0:1.5.0-2.el9pc
python3.12-galaxy-importer< 0:0.4.33-1.el9pc
python3.12-gitdb< 0:4.0.12-2.el9pc
python3.12-gitpython< 0:3.1.46-1.el9pc
python3.12-gnupg< 0:0.5.4-1.el9pc
python3.12-googleapis-common-protos< 0:1.72.0-1.el9pc
python3.12-grpcio< 0:1.70.0-2.el9pc
python3.12-grpcio-debuginfo< 0:1.70.0-2.el9pc
python3.12-grpcio-debugsource< 0:1.70.0-2.el9pc
python3.12-gunicorn< 0:23.0.0-3.el9pc
python3.12-idna< 0:3.11-1.el9pc
python3.12-importlib-metadata< 0:6.0.1-6.el9pc
python3.12-importlib-resources< 0:6.4.5-2.el9pc
python3.12-inflection< 0:0.5.1-8.el9pc
python3.12-iniparse< 0:0.5-2.el9pc
python3.12-jinja2< 0:3.1.5-2.el9sat
python3.12-jq< 0:1.8.0-2.el9pc
python3.12-json_stream< 0:2.3.4-1.el9pc
python3.12-json_stream_rs_tokenizer< 0:0.4.28-2.el9pc
python3.12-jsonschema< 0:4.10.3-6.el9pc
python3.12-libcomps< 0:0.1.23-1.el9pc
python3.12-libcomps-debuginfo< 0:0.1.23-1.el9pc
python3.12-lockfile< 0:0.12.2-3.el9sat
python3.12-markdown< 0:3.8.2-1.el9pc
python3.12-markdown-it-py< 0:2.2.0-1.el9pc
python3.12-markuppy< 0:1.14-8.el9pc
python3.12-markupsafe< 0:3.0.2-2.el9sat
python3.12-mccabe< 0:0.7.0-5.el9pc
python3.12-mdurl< 0:0.1.2-2.el9pc
python3.12-multidict< 0:6.4.3-1.el9pc
python3.12-multidict-debuginfo< 0:6.4.3-1.el9pc
python3.12-multidict-debugsource< 0:6.4.3-1.el9pc
python3.12-nh3< 0:0.3.0-1.el9pc
python3.12-odfpy< 0:1.4.1-11.el9pc
python3.12-openpyxl< 0:3.1.5-2.el9pc

Show all 182

Chainguard6 products

authentik< 2025.10.1-r4
openssl< 3.5.4-r0
openssl-provider-fipsAll versions (No fix recorded)
openssl-provider-fips-3.1.2All versions (No fix recorded)
openssl-provider-fips-3.4.0All versions (No fix recorded)

Show all 6

Ubuntu4 products

nodejsAll versions (No fix recorded)
openssl< 1.0.1f-1ubuntu2.27+esm11 | < 1.0.2g-1ubuntu4.20+esm13 | < 1.0.2g-1ubuntu4.fips.4.20.13 | All versions (No fix recorded) | < 1.1.1-1ubuntu2.1~18.04.23+esm6 | < 1.1.1-1ubuntu2.fips.2.1~18.04.23.6 | < 1.1.1f-1ubuntu2.24+esm1 | < 1.1.1f-1ubuntu2.fips.24.1 | < 3.0.2-0ubuntu1.20 | < 3.0.2-0ubuntu1.20+Fips1 | < 3.0.13-0ubuntu3.6 | < 3.5.3-1ubuntu2
openssl-fipsAll versions (No fix recorded) | < 3.0.13-0ubuntu3.6+Fips1
openssl1.0< 1.0.2n-1ubuntu5.13+esm2

Opensuse3 products

openssl-1_0_0&distro=openSUSE Leap 15.6< 1.0.2p-150000.3.97.1
openssl-1_1&distro=openSUSE Leap 15.6< 1.1.1w-150600.5.18.1
openssl-3&distro=openSUSE Leap 15.6< 3.1.4-150600.5.39.1

Alpine1 product

openssl< 3.0.19-r0 | < 3.1.8-r1 | < 3.3.5-r0 | < 3.5.4-r0

Debian1 product

openssl< 1.1.1w-0+deb11u4 | < 3.0.17-1~deb12u3 | < 3.5.1-1+deb13u1 | < 3.5.4-1

Mageia1 product

openssl< 3.0.18-1.mga9

Openssl1 product

openssl≥ 3.5.0, < 3.5.4 | ≥ 3.4.0, < 3.4.3 | ≥ 3.3.0, < 3.3.5 | ≥ 3.2.0, < 3.2.6 | ≥ 3.0.0, < 3.0.18 | ≥ 1.1.1, < 1.1.1zd | ≥ 1.0.2, < 1.0.2zm

Wolfi1 product

openssl< 3.5.4-r0

9 vendors · 200 products · Showing 200 of 698. Use Open JSON for the complete list.

References

292 links

Show all 100 references

Showing 100 of 292. Use Open JSON for the complete list.

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities