LiveActive security incident?Get immediate response
CVE Record

CVE-2019-25049: LibreSSL 2.9.1 through 3.2.1 has an out-of-bounds read in asn1_item_print_ctx (called from asn1_template_pr...

LibreSSL 2.9.1 through 3.2.1 has an out-of-bounds read in asn1_item_print_ctx (called from asn1_template_print_ctx).

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

LibreSSL versions 2.9.1 through 3.2.1 contain an out-of-bounds read while printing ASN.1 structures. Business impact is unclear because the public record provides no CVSS score, no named attack scenario, and no active exploitation evidence. Treat it as a dependency hygiene issue unless affected systems parse untrusted certificate or ASN.1 data.

Executive priority

Set priority after confirming exposure. For most organizations this is a moderate dependency review item, but it becomes more urgent where LibreSSL handles untrusted certificate or ASN.1 data in exposed services.

Technical view

The flaw is an out-of-bounds read in LibreSSL asn1_item_print_ctx, reached through asn1_template_print_ctx. Public sources identify affected versions as 2.9.1 through 3.2.1 and link to an upstream commit, an OSS-Fuzz issue, and OSV metadata, but do not provide CVSS, CWE, exploitability details, or a named fixed release.

Likely exposure

Exposure is most likely in systems bundling or dynamically linking LibreSSL 2.9.1 through 3.2.1, especially software that processes certificates or other ASN.1 data. The provided affected-product metadata is incomplete, so asset confirmation is required.

Exploitation context

CISA KEV status is false in the bundle, and no cited source states active exploitation. The reference set points to OSS-Fuzz and OSV tracking, suggesting the issue was publicly identified through vulnerability research or fuzzing rather than reported exploitation.

Researcher notes

Public evidence is sparse: no CVSS, no CWE, no exploit status, and no detailed impact beyond out-of-bounds read. Do not assume remote code execution. Focus analysis on reachable ASN.1 printing paths, vulnerable version presence, and vendor-fixed package status.

Mitigation direction

  • Inventory systems and applications using LibreSSL 2.9.1 through 3.2.1.
  • Check LibreSSL and operating-system vendor guidance for fixed packages.
  • Update affected LibreSSL packages when a vendor-supported fix is available.
  • Prioritize externally exposed services that parse untrusted certificates or ASN.1 data.
  • Retire unsupported software that bundles vulnerable LibreSSL versions.

Validation and detection

  • Confirm LibreSSL versions through package inventories, SBOMs, or build manifests.
  • Identify applications dynamically or statically linked against LibreSSL.
  • Review whether affected applications process untrusted ASN.1 or certificate inputs.
  • Check vendor advisories for whether deployed builds include the referenced upstream fix.
  • Review crash logs for LibreSSL ASN.1 printing failures if relevant.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2019-25049 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.