Skip to content
OpenAdvisories
Critical SA26P003 2 CVEs

OpenSSL Vulnerabilities in B&R products

Published Nov 9, 2026 · Updated Nov 9, 2026

Vendor: B&R Industrial Automation Product: ADI OPC UA Server Product: Automation Runtime Product: B&R Linux 12 Product: B&R Live Utils Product: mapp View Product: OPC UA C/S TP Product: PFT50 Product: PFT51 Product: PPC50 Product: PPC80 Product: PPT30 Product: PPT50 Product: PPT80 Product: ​​PVI​ Product: Terminal OS

Summary

B&R is aware of public reports of a vulnerability in the product versions listed as affected in the advisory.

An attacker who successfully exploited this vulnerability could cause the product to stop or insert and run arbitrary code.

Vulnerabilities 2

  • High 8.8
    CVE-2025-15467 Public exploit EPSS 75%

    Stack buffer overflow in CMS (Auth)EnvelopedData parsing

    Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote c…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Alpine
  • Medium 6.1
    CVE-2025-11187 Public exploit

    Improper validation of PBMAC1 parameters in PKCS#12 MAC verification

    Issue summary: PBMAC1 parameters in PKCS#12 files are missing validation which can trigger a stack-based buffer overflow, invalid pointer or NULL pointer dereference during MAC verification. Impact summary: The stack buffer overflow or NULL pointer dereferenc…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Alpine

Revision history

  1. #1

    Initial version.

References