OpenSSL Vulnerabilities Allow Private Key Recovery, Code Execution, DoS Attacks

Three vulnerabilities in OpenSSL have been patched in the latest updates, with several versions released to fix them, including 3.5.4, 3.4.3, 3.3.5, 3.2.6, 3.0.18, 1.0.2zm and 1.1.1zd. Two of the flaws are rated moderate, one of which is CVE-2025-9231 and may allow an attacker to recover the private key, according to the OpenSSL Project, which notes limited impact on SM2 keys on 64-bit ARM platforms.

CVE-2025-9230 is described as an out-of-bounds read/write issue that can be exploited for arbitrary code execution or DoS attacks, also rated moderate. The third vulnerability is low severity and can be exploited to trigger a crash that leads to a DoS condition. Security officials are advised to apply the patched versions to mitigate private key recovery and potential code execution or disruption, as noted in the security advisory. Written by Eduard Kovacs for SecurityWeek, dated 1 October 2025.