What is the severity of CVE-2025-35471?

CVE-2025-35471 is classified as a high-severity vulnerability due to the potential for non-privileged local users to gain unauthorized access.

How do I fix CVE-2025-35471?

To fix CVE-2025-35471, update the conda-forge openssl-feedstock to version 066e83c or later.

What systems are affected by CVE-2025-35471?

CVE-2025-35471 affects Microsoft Windows systems using the conda-forge openssl-feedstock prior to version 066e83c.

Can non-privileged users exploit CVE-2025-35471?

Yes, a non-privileged local user can exploit CVE-2025-35471 by writing a crafted openssl.cnf file in the OPENSSLDIR.

What is the risk associated with CVE-2025-35471?

The risk associated with CVE-2025-35471 includes the potential for arbitrary code execution by non-privileged users through the misconfigured OPENSSLDIR.

Vulnerability/
CVE-2025-35471

high

7.3

CWE

427

13/5/2025

CVE-2025-35471: conda-forge openssl-feedstock writable OPENSSLDIR

First published: Tue May 13 2025(Updated: )

conda-forge openssl-feedstock before 066e83c (2024-05-20), on Microsoft Windows, configures OpenSSL to use an OPENSSLDIR file path that can be written to by non-privilged local users. By writing a specially crafted openssl.cnf file in OPENSSLDIR, a non-privileged local user can execute arbitrary code with the privileges of the user or process loading openssl-feedstock DLLs. Miniforge before 24.5.0 is also affected.

Credit: 9119a7d8-5eab-497f-8521-727c672e3725

Affected Software	Affected Version	How to fix
conda-forge openssl-feedstock	<066e83c
Miniforge	<24.5.0

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of CVE-2025-35471?
CVE-2025-35471 is classified as a high-severity vulnerability due to the potential for non-privileged local users to gain unauthorized access.
How do I fix CVE-2025-35471?
To fix CVE-2025-35471, update the conda-forge openssl-feedstock to version 066e83c or later.
What systems are affected by CVE-2025-35471?
CVE-2025-35471 affects Microsoft Windows systems using the conda-forge openssl-feedstock prior to version 066e83c.
Can non-privileged users exploit CVE-2025-35471?
Yes, a non-privileged local user can exploit CVE-2025-35471 by writing a crafted openssl.cnf file in the OPENSSLDIR.
What is the risk associated with CVE-2025-35471?
The risk associated with CVE-2025-35471 includes the potential for arbitrary code execution by non-privileged users through the misconfigured OPENSSLDIR.

collector/mitre-cve
source/MITRE
agent/references
agent/title
agent/weakness
agent/type
agent/description
agent/first-publish-date
agent/guess-ai
agent/software-canonical-lookup
agent/software-canonical-lookup-request
agent/softwarecombine
collector/nvd-api
source/NVD
agent/author
agent/last-modified-date
agent/severity
agent/source
agent/tags
agent/event
vendor/conda-forge
canonical/conda-forge openssl-feedstock
canonical/miniforge

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.