OpenSSL patches 3 vulnerabilities, urging immediate updates

OpenSSL has released security updates addressing three vulnerabilities, tracked as CVE-2025-9230, CVE-2025-9231, and CVE-2025-9232, with patched OpenSSL library versions including 3.5.4, 3.4.3, 3.3.5, 3.2.6, 3.0.18, 1.0.2zm and 1.1.1zd. CVE-2025-9230 is a flaw in CMS decryption with password-based encryption that can cause an out-of-bounds read/write, leading to crashes or memory corruption and potentially code execution; the risk is described as moderate and FIPS modules are unaffected.

According to the advisory, this “out-of-bounds read may trigger a crash which leads to Denial of Service for an application” and “out-of-bounds write can cause memory corruption” with potential DoS or execution of attacker-supplied code, though the probability of exploitation is considered low.

The second flaw, CVE-2025-9231, involves SM2 signature computations on 64-bit ARM platforms and introduces a timing side-channel that could allow private-key recovery; exploitation remains theoretical but updates are recommended. The third vulnerability is a low-severity issue that can cause crashes and a DoS condition, with OpenSSL noting improvements since Heartbleed. The report, published on 1 October 2025, highlights that OpenSSL urges users to update as soon as possible. according to The OpenSSL Project.