Microsoft Office Zero-Day CVE-2026-21509

Multiple vulnerabilities have been identified in OpenSSL that could lead to remote code execution, denial of service (DoS), integrity bypass, memory corruption, and information disclosure. OpenSSL is widely embedded across servers, appliances, and applications providing TLS/SSL and cryptographic handling, so downstream exposure can be broad even when OpenSSL is not deployed “directly” by customers. Several issues are triggered by processing attacker-supplied cryptographic content (notably PKCS#12 and CMS/PKCS#7), meaning risk increases for services that accept or parse untrusted certificates, signed content, or encrypted messages.

CVE
This advisory includes multiple CVEs; key high-impact items include: CVE-2025-15467 (CMS AEAD parsing overflow with potential RCE) and PKCS#12 parsing issues with crash/RCE potential, alongside additional DoS and integrity-impacting flaws as detailed in the OpenSSL vulnerability disclosures.

Targeting / Delivery Mechanism
Attackers may deliver malicious PKCS#12 files, crafted CMS/PKCS#7 messages (e.g., S/MIME), or malformed cryptographic structures to applications that parse untrusted content. Internet-facing services, email security gateways, or internal tooling that automatically processes certificates or signed/encrypted content are most exposed.

Execution Technique
Exploitation conditions vary by CVE and include stack/heap out-of-bounds writes during ASN.1 parsing, NULL dereference crashes, integrity gaps in CLI tooling, and memory corruption during PKCS#12 friendly-name handling.

Persistence / Deployment
If code execution is achieved, attackers could run arbitrary payloads under the affected service context, establish persistence, and pivot laterally. DoS-focused issues can still be used to degrade availability and disrupt dependent services.