It seems that we have another remote code execution in recent OpenSSL versions (CVE-2025-15467), this time in AEAD component.
Debian advisory is here. From openssl advisory it seems that it mainly affects less popular use-cases
`
Applications and services that parse untrusted CMS or PKCS#7 content using AEAD ciphers (e.g., S/MIME AuthEnvelopedData with AES-GCM) are vulnerable. Because the overflow occurs prior to authentication, no valid key material is required to trigger it. While exploitability to remote code execution depends on platform and toolchain mitigations, the stack-based write primitive represents a severe risk.
`
