OpenSSL fixes 12 flaws credited to AISLE's AI analyzer, including a high-severity CMS stack overflow

On January 27, 2026, OpenSSL published a security advisory covering 12 CVEs. The only high-severity one, CVE-2025-15467, affects parsing of CMS AuthEnvelopedData and EnvelopedData messages that use AEAD ciphers such as AES-GCM: an oversized IV in the message is copied into a fixed stack buffer before any authentication, so no valid key is needed. OpenSSL says this can crash the process and may allow remote code execution, depending on platform protections. Apps that parse untrusted CMS or PKCS#7 content, such as S/MIME, are exposed. OpenSSL 3.0 through 3.6 are affected; 1.1.1, 1.0.2 and the FIPS modules are not.

The rest are one moderate issue, CVE-2025-11187, a PBMAC1 validation bug in PKCS#12 MAC checks on 3.4 to 3.6, and ten low-severity bugs. OpenSSL credits Aisle Research for all 12, with CVE-2025-11187 also reported independently by Hamza of Metadust. In a January 26 post, AISLE says its autonomous analyzer found all 12, that its proposed patches were adopted directly for five of them, and that six more findings were fixed before the vulnerable code ever shipped. AISLE also credits OpenSSL maintainers with validating the reports and developing the final fixes.

Upgrade to OpenSSL 3.6.1, 3.5.5, 3.4.4, 3.3.6 or 3.0.19. A few low-severity issues also reach 1.1.1 and 1.0.2, fixed in 1.1.1ze and 1.0.2zn for premium support customers only. Most businesses do not install OpenSSL directly: it arrives through operating system packages, language runtimes and container base images, so update your distribution's packages, rebuild images and restart services that link it.