CVE-2025-55118CWE-122CWE-125CWE-191CWE-415CWE-416CWE-665CWE-787CWE-835
BMC Control-M/Agent memory corruption in SSL/TLS communication
High · published September 16, 2025
What it is
Memory corruptions can be remotely triggered in the Control-M/Agent when SSL/TLS communication is configured.
The issue occurs in the following cases:
* Control-M/Agent 9.0.20: SSL/TLS configuration is set to the non-default setting "use_openssl=n";
* Control-M/Agent 9.0.21 and 9.0.22: Agent router configuration uses the non-default settings "JAVA_AR=N" and "use_openssl=n"
The record
Technical detail
- CVSS v4.0
- 8.4 · HIGH
- Vector
- CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:L/SA:L
- EPSS
- 0.00368 · 29.5th percentile
- Weaknesses
- CWE-122 · Heap-based Buffer Overflow; CWE-125 · Out-of-bounds Read; CWE-191 · Integer Underflow (Wrap or Wraparound); CWE-415 · Double Free; CWE-416 · Use After Free; CWE-665 · Improper Initialization; CWE-787 · Out-of-bounds Write; CWE-835 · Loop with Unreachable Exit Condition ('Infinite Loop')
- Published
- 2025-09-16T12:23Z
EPSS history
Timeline