Log in Start free

Vulnerability · Published Sep 16, 2025 · Assigned by airbus

CVE-2025-55117BMC Control-M/Agent buffer overflow in SSL/TLS communication

Medium 5.3

In plain English

A medium-severity stack buffer overflow in Control-M/Agent from BMC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.3%top 73.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A stack-based buffer overflow can be remotely triggered when formatting an error message in the Control-M/Agent when SSL/TLS communication is configured. The issue occurs in the following cases: * Control-M/Agent 9.0.20: SSL/TLS configuration is set to the non-default setting "use_openssl=n"; * Control-M/Agent 9.0.21 and 9.0.22: Agent router configuration uses the non-default settings "JAVA_AR=N" and "use_openssl=n".

Affected products (as reported)

VendorProductVersions
BMC Control-M/Agent 9.0.22.0009.0.219.0.209.0.199.0.18

Weakness: CWE-121 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References