CVE-2025-55118 HIGH

CVE-2025-55118: BMC Control-M/Agent memory corruption in SSL/TLS communication

Vendor Bmc
Product Control-M/Agent
Weakness CWE-122
Published September 16, 2025
Last update November 18, 2025
View on NVD All CVEs

CVSS base score

8.4/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:L/SA:L

What the vulnerability does

01Description

Memory corruptions can be remotely triggered in the Control-M/Agent when SSL/TLS communication is configured. The issue occurs in the following cases: * Control-M/Agent 9.0.20: SSL/TLS configuration is set to the non-default setting "use_openssl=n"; * Control-M/Agent 9.0.21 and 9.0.22: Agent router configuration uses the non-default settings "JAVA_AR=N" and "use_openssl=n"

Key dates

02Disclosure timeline

September 16, 2025 CVE published
November 18, 2025 Record updated