CVE-2025-69420
Published: 27 January 2026
Summary
CVE-2025-69420 is a high-severity Improper Check for Unusual or Exceptional Conditions (CWE-754) vulnerability in Openssl Openssl. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked in the top 21.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-11 (Error Handling).
Deeper analysis
A type confusion vulnerability exists in OpenSSL's TimeStamp Response verification code where an ASN1_TYPE union member is accessed without first validating the type. This affects the functions ossl_ess_get_signing_cert() and ossl_ess_get_signing_cert_v2() and impacts OpenSSL versions 3.6, 3.5, 3.4, 3.3, 3.0, and 1.1.1, while FIPS modules in those releases and version 1.0.2 remain unaffected. Processing a malformed TimeStamp Response file through TS_RESP_verify_response() triggers an invalid or NULL pointer dereference that crashes the application.
An unauthenticated attacker can supply a crafted TimeStamp Response to any application performing timestamp verification, resulting in a denial of service. The TimeStamp protocol defined in RFC 3161 is not widely deployed, and the only achievable impact is a crash rather than code execution or data compromise, leading to an overall low-severity rating despite the CVSS score of 7.5.
References to OpenSSL repository commits indicate that patches have been prepared to address the missing type checks before ASN1_TYPE access. The EPSS score has remained flat at 0.0113 with no material rise after disclosure, and no information is provided on real-world exploitation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-206394
Vulnerability details
Issue summary: A type confusion vulnerability exists in the TimeStamp Response verification code where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing a malformed TimeStamp Response file. Impact…
more
summary: An application calling TS_RESP_verify_response() with a malformed TimeStamp Response can be caused to dereference an invalid or NULL pointer when reading, resulting in a Denial of Service. The functions ossl_ess_get_signing_cert() and ossl_ess_get_signing_cert_v2() access the signing cert attribute value without validating its type. When the type is not V_ASN1_SEQUENCE, this results in accessing invalid memory through the ASN1_TYPE union, causing a crash. Exploiting this vulnerability requires an attacker to provide a malformed TimeStamp Response to an application that verifies timestamp responses. The TimeStamp protocol (RFC 3161) is not widely used and the impact of the exploit is just a Denial of Service. For these reasons the issue was assessed as Low severity. The FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the TimeStamp Response implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue. OpenSSL 1.0.2 is not affected by this issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Directly enables application crash/DoS via exploitation of the type confusion vulnerability in OpenSSL timestamp verification (T1499.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely identification, reporting, and patching of flaws like the OpenSSL type confusion vulnerability in TimeStamp Response verification.
Mandates validation of information inputs such as ASN.1 types in TimeStamp Responses to prevent invalid union member access and pointer dereferences.
Ensures error conditions from malformed TimeStamp Responses are handled without crashing the application, mitigating the denial-of-service impact.