Solution
CVE-2025-15467, disclosed on 1/27/2026, is a vulnerability in CMS AuthEnvelopedData. This is commonly used in S/MIME (email), which is not our use case for OpenSSL.
Furthermore, the vulnerability specifically resides in the function evp_cipher_get_asn1_aead_params(). NI has searched our code and confirmed we do not make any calls to this function.
In conclusion, our usage of OpenSSL is not affected by this issue, making our software compliant with CVE_2025-15467.