OpenSSL Vulnerabilities Allow Remote Attackers to Execute Malicious Code

OpenSSL released patches for a set of vulnerabilities (Jan 27, 2026), notably CVE-2025-15467 — a High-severity stack overflow in CMS/PKCS#7 parsing that can be triggered by crafted ASN.1 parameters and may enable remote code execution in applications that parse untrusted CMS/S/MIME data; multiple other moderate-to-low issues affect PKCS#12, QUIC lookups, BIO buffering, and TLS 1.3 certificate compression. The advisory enumerates affected versions and fixed releases, credits researchers, and urges immediate upgrades and input validation to mitigate remote crash or code-execution risks.