What is CVE-2025-35471?

CVE-2025-35471 is a high-severity vulnerability in Conda-forge Miniforge, classified under Uncontrolled Search Path Element. CVSS score: 7.3/10. Published 2025-05-13.

How severe is CVE-2025-35471?

High severity. CVSS v3 base score is 7.3 out of 10.

Is CVE-2025-35471 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Conda-forge Miniforge

CVE-2025-35471

conda-forge openssl-feedstock before 066e83c (2024-05-20), on Microsoft Windows, configures OpenSSL to use an OPENSSLDIR file path that can be written to by non-privilged local users. By writing a specially crafted openssl.cnf file in OPEN…

EPSS: 0.002 (8.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H.

Affected products

Conda-forge Miniforge — versions 0, 24.5.0
Conda-forge Openssl-feedstock — versions 0, 066e83c
Microsoft Windows

Weakness classification (CWE)

CWE-427 — Uncontrolled Search Path Element

Public proof-of-concept exploits

chnzzh/OpenSSL-CVE-lib

References

9119a7d8-5eab-497f-8521-727c672e3725 (Patch)
9119a7d8-5eab-497f-8521-727c672e3725 (Exploit, Issue Tracking)

Frequently asked questions

What is CVE-2025-35471?: CVE-2025-35471 is a high-severity vulnerability in Conda-forge Miniforge, classified under Uncontrolled Search Path Element. CVSS score: 7.3/10. Published 2025-05-13.
How severe is CVE-2025-35471?: High severity. CVSS v3 base score is 7.3 out of 10.
Is CVE-2025-35471 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.