LiveActive security incident?Get immediate response
CVE Record

CVE-2019-25048: LibreSSL 2.9.1 through 3.2.1 has a heap-based buffer over-read in do_print_ex (called from asn1_item_print_...

LibreSSL 2.9.1 through 3.2.1 has a heap-based buffer over-read in do_print_ex (called from asn1_item_print_ctx and ASN1_item_print).

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

LibreSSL versions 2.9.1 through 3.2.1 contain a heap-based buffer over-read in ASN.1 printing code. In business terms, affected software may read past intended memory while formatting ASN.1 data. The public bundle does not provide CVSS, confirmed impact, or active exploitation evidence.

Executive priority

Treat this as an inventory-and-patch hygiene item until vendor severity is clearer. It should rise in priority for products processing external ASN.1 data, but the bundle does not justify emergency response language or active-exploitation assumptions.

Technical view

The flaw is a heap-based buffer over-read in do_print_ex, reachable via asn1_item_print_ctx and ASN1_item_print. Sources identify LibreSSL 2.9.1 through 3.2.1 and reference an upstream commit plus OSS-Fuzz tracking. No CWE, CVSS vector, or detailed exploitability assessment is provided in the bundle.

Likely exposure

Exposure is most likely where applications or appliances bundle LibreSSL 2.9.1 through 3.2.1 and print or inspect ASN.1 structures from potentially untrusted input. The source bundle does not identify specific downstream products, distributions, or public-facing services.

Exploitation context

CISA KEV status is false, and the provided sources do not state active exploitation. The OSS-Fuzz references suggest discovery through fuzz testing, but the bundle does not prove real-world attack use or provide confirmed impact beyond over-read behavior.

Researcher notes

The key technical evidence is the CVE description, OSS-Fuzz tracking, OSV entry, and LibreSSL portable commit. The bundle lacks CVSS, CWE, proof of exploitation, and downstream product mapping, so conclusions should remain limited to affected LibreSSL versions and ASN.1 print-path exposure.

Mitigation direction

  • Inventory systems and applications bundling LibreSSL 2.9.1 through 3.2.1.
  • Check LibreSSL, OS vendor, and appliance vendor guidance for fixed packages.
  • Confirm whether builds include upstream commit 17c88164016df821df2dff4b2b1291291ec4f28a.
  • Prioritize updates where ASN.1 printing handles untrusted or external input.
  • Monitor vendor advisories for clarified severity and downstream affected products.

Validation and detection

  • Review SBOMs, package manifests, and static builds for LibreSSL versions.
  • Check runtime-linked libraries for LibreSSL 2.9.1 through 3.2.1.
  • Identify code paths calling ASN1_item_print or ASN.1 diagnostic formatting.
  • Verify patched builds include the referenced upstream fix or vendor equivalent.
  • Record unknowns where bundled LibreSSL provenance cannot be confirmed.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2019-25048 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.