⚡ Potentially Critical RCE Vulnerability in OpenSSL - CVE-2025-15467 ⚡ The JFrog Security Research team is tracking a newly disclosed OpenSSL stack overflow vulnerability rated as High by OpenSSL, that may lead to remote code execution (RCE). This vulnerability was patched with other 11 moderate and low severity vulnerabilities. The stack overflow can be triggered by sending a crafted CMS AuthEnvelopedData message with malicious AEAD parameters. While no official CVSS score has been assigned yet, based on its characteristics, we assess it may be rated at least High or even Critical by NVD. Our team reproduced the issue by invoking the CMS_decrypt API directly, confirming that OpenSSL applications parsing untrusted CMS data via this API are vulnerable. Exploitation is also possible when using the `openssl cms` CLI to decrypt untrusted input. A contextual analysis scanner for this CVE is now available for JFrog Advanced Security customers: