Log in Start free

Vulnerability · Published Sep 16, 2025 · Assigned by airbus

CVE-2025-55118BMC Control-M/Agent memory corruption in SSL/TLS communication

High 8.9

In plain English

A high-severity heap buffer overflow in Control-M/Agent from BMC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).

Severity (CVSS 3.1)8.9High
Exploit odds (30 days)0.4%top 69.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Memory corruptions can be remotely triggered in the Control-M/Agent when SSL/TLS communication is configured. The issue occurs in the following cases: * Control-M/Agent 9.0.20: SSL/TLS configuration is set to the non-default setting "use_openssl=n"; * Control-M/Agent 9.0.21 and 9.0.22: Agent router configuration uses the non-default settings "JAVA_AR=N" and "use_openssl=n"

Affected products (as reported)

VendorProductVersions
BMC Control-M/Agent 9.0.22.0009.0.219.0.209.0.199.0.18

Weakness: CWE-122, CWE-125, CWE-787, CWE-191, CWE-665, CWE-835, CWE-415, CWE-416 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H

References