CVE-2025-55117: BMC Control-M/Agent Buffer Overflow Flaw

CVE-2025-55117 Overview

CVE-2025-55117 is a stack-based buffer overflow in BMC Control-M/Agent that can be triggered remotely when the agent formats an error message during SSL/TLS communication. The flaw affects Control-M/Agent versions 9.0.20, 9.0.21, and 9.0.22 under specific non-default configurations. On version 9.0.20 it manifests when use_openssl=n is set. On versions 9.0.21 and 9.0.22 it requires the agent router configuration JAVA_AR=N combined with use_openssl=n. The weakness is classified as [CWE-121] Stack-based Buffer Overflow.

Critical Impact
A network-adjacent attacker can remotely corrupt the Control-M/Agent stack by triggering an error message formatting path in the SSL/TLS handler, potentially disrupting scheduled job execution across the Control-M environment.

Affected Products

BMC Control-M/Agent 9.0.20 (when use_openssl=n is configured)
BMC Control-M/Agent 9.0.21 (when JAVA_AR=N and use_openssl=n are configured)
BMC Control-M/Agent 9.0.22 (when JAVA_AR=N and use_openssl=n are configured)

Discovery Timeline

2025-09-16 - CVE-2025-55117 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-55117

Vulnerability Analysis

The vulnerability resides in the error-message formatting logic invoked by the Control-M/Agent when SSL/TLS communication is configured without OpenSSL. When the agent encounters a communication error, it constructs a diagnostic string using a fixed-size stack buffer. Attacker-influenced input reaches this format routine without adequate length validation, allowing the write operation to exceed the destination buffer boundary and corrupt adjacent stack memory.

Because the flaw is exercised during error handling on the SSL/TLS code path, an attacker only needs to induce an error condition against the listening agent. The attack requires no authentication and no user interaction, and it is reachable across the network wherever the agent is exposed to attacker-controlled peers.

Root Cause

The root cause is missing bounds enforcement when the agent formats a diagnostic message into a stack-allocated buffer. This class of defect is tracked as [CWE-121]. The vulnerable path is only reached when the operator disables OpenSSL by setting use_openssl=n, forcing the agent to use the alternative TLS routines that contain the unsafe formatting logic. On 9.0.21 and 9.0.22, the Java-based agent router (JAVA_AR=Y) shields the affected code, so exposure requires the additional non-default JAVA_AR=N setting.

Attack Vector

A remote unauthenticated attacker delivers crafted data to the Control-M/Agent SSL/TLS listener to trigger the error-formatting path. Successful exploitation corrupts the stack frame of the handling thread. Public reporting to date describes an integrity impact without confirmed code execution, but stack corruption in a long-running scheduling agent creates a strong denial-of-service and potential control-flow risk. No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The current EPSS score is 0.308%.

No verified exploit code is available. Refer to the BMC Knowledge Article #000441972 and BMC Knowledge Article #000442099 for vendor technical details.

Detection Methods for CVE-2025-55117

Indicators of Compromise

Unexpected termination or repeated restarts of the p_ctmag Control-M/Agent process on hosts running 9.0.20 through 9.0.22.
Malformed or truncated TLS handshake attempts against the agent listener port from unknown external sources.
Stack corruption traces, core dumps, or SIGSEGV events generated by the agent immediately after an SSL/TLS error is logged.
Agent log entries showing repeated error-formatting failures coincident with connection attempts.

Detection Strategies

Inventory all Control-M/Agent installations and flag any host where use_openssl=n is present in the agent configuration.
On 9.0.21 and 9.0.22, additionally flag hosts where JAVA_AR=N is set, since the vulnerable code path requires both options.
Correlate agent crash telemetry with inbound TLS connection attempts to identify probing activity.
Apply behavioral endpoint monitoring to detect anomalous child-process creation or memory abuse originating from the agent binary.

Monitoring Recommendations

Forward Control-M/Agent logs and host process telemetry into a centralized SIEM for correlation with network flow data.
Alert on unauthorized inbound connections to the agent port from outside the Control-M management subnet.
Track configuration drift on the use_openssl and JAVA_AR parameters as a compliance signal.

How to Mitigate CVE-2025-55117

Immediate Actions Required

Identify all Control-M/Agent 9.0.20, 9.0.21, and 9.0.22 instances in the environment and confirm their SSL/TLS settings.
Restore the default use_openssl=y setting wherever operationally feasible to remove the vulnerable code path.
On 9.0.21 and 9.0.22, restore JAVA_AR=Y so the Java agent router handles TLS instead of the affected native routine.
Restrict inbound access to the agent listener port to trusted Control-M/Server hosts using host and network firewalls.

Patch Information

BMC has published remediation guidance in BMC Knowledge Article #000441972 and BMC Knowledge Article #000442099. Administrators should apply the fixed agent build referenced in these advisories for versions 9.0.20, 9.0.21, and 9.0.22.

Workarounds

Set use_openssl=y on Control-M/Agent 9.0.20 to route SSL/TLS through the OpenSSL implementation.
Set JAVA_AR=Y on 9.0.21 and 9.0.22 so the Java agent router handles TLS communication.
Segment Control-M/Agent hosts on a management VLAN and permit connections only from authorized Control-M/Server components.
Disable the SSL/TLS listener entirely if the agent does not require encrypted communication in the deployment.

bash

# Configuration example: restore default, non-vulnerable settings in the Control-M/Agent config
# 9.0.20
use_openssl=y

# 9.0.21 and 9.0.22
JAVA_AR=Y
use_openssl=y