CVE-2025-69418
published 2026-01-27CVE-2025-69418: Issue summary: When using the low-level OCB API directly with AES-NI orother hardware-accelerated code paths, inputs whose length is not a multipleof 16 bytes…
PriorityP419medium4CVSS 3.1
AVLACHPRNUINSUCLILAN
EPSS
0.11%
1.8th percentile
Issue summary: When using the low-level OCB API directly with AES-NI orother hardware-accelerated code paths, inputs whose length is not a multipleof 16 bytes can leave the final partial block unencrypted and unauthenticated.Impact summary: The trailing 1-15 bytes of a message may be exposed incleartext on encryption and are not covered by the authentication tag,allowing an attacker to read or tamper with those bytes without detection.The low-level OCB encrypt and decrypt routines in the hardware-acceleratedstream path process full 16-byte blocks but do not advance the input/outputpointers. The subsequent tail-handling code then operates on the originalbase pointers, effectively reprocessing the beginning of the buffer whileleaving the actual trailing bytes unprocessed. The authentication checksumalso excludes the true tail bytes.However, typical OpenSSL consumers using EVP are not affected because thehigher-level EVP and provider OCB implementations split inputs so that fullblocks and trailing partial blocks are processed in separate calls, avoidingthe problematic code path. Additionally, TLS does not use OCB ciphersuites.The vulnerability only affects applications that call the low-levelCRYPTO_ocb128_encrypt() or CRYPTO_ocb128_decrypt() functions directly withnon-block-aligned lengths in a single call on hardware-accelerated builds.For these reasons the issue was assessed as Low severity.The FIPS modules in 3.6, 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affectedby this issue, as OCB mode is not a FIPS-approved algorithm.OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.OpenSSL 1.0.2 is not affected by this issue.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | openssl | < openssl 3.0.18-1~deb12u2 (bookworm) | openssl 3.0.18-1~deb12u2 (bookworm) |
| openssl | openssl | >= 0 < 1.1.1w-0+deb11u5 | 1.1.1w-0+deb11u5 |
| openssl | openssl | >= 0 < 3.0.18-1~deb12u2 | 3.0.18-1~deb12u2 |
| openssl | openssl | >= 0 < 3.5.4-1~deb13u2 | 3.5.4-1~deb13u2 |
| openssl | openssl | >= 0 < 3.5.5-1 | 3.5.5-1 |
| openssl | openssl | >= 0 < 3.0.2-0ubuntu1.21 | 3.0.2-0ubuntu1.21 |
| openssl | openssl | >= 0 < 3.0.13-0ubuntu3.7 | 3.0.13-0ubuntu3.7 |
| openssl | openssl | >= 0 < 3.5.3-1ubuntu3 | 3.5.3-1ubuntu3 |
| openssl | openssl | >= 0 < 1.0.1f-1ubuntu2.27+esm12 | 1.0.1f-1ubuntu2.27+esm12 |
| openssl | openssl | >= 0 < 1.0.2g-1ubuntu4.20+esm14 | 1.0.2g-1ubuntu4.20+esm14 |
| openssl | openssl | >= 0 < 1.1.1-1ubuntu2.1~18.04.23+esm7 | 1.1.1-1ubuntu2.1~18.04.23+esm7 |
| openssl | openssl | >= 0 < 1.1.1f-1ubuntu2.24+esm2 | 1.1.1f-1ubuntu2.24+esm2 |
| openssl | openssl | >= 1.1.1 < 1.1.1ze | 1.1.1ze |
| openssl | openssl | >= 3.0.0 < 3.0.19 | 3.0.19 |
| openssl | openssl | >= 3.3.0 < 3.3.6 | 3.3.6 |
| openssl | openssl | >= 3.4.0 < 3.4.4 | 3.4.4 |
| openssl | openssl | >= 3.5.0 < 3.5.5 | 3.5.5 |
| openssl | openssl | >= 3.6.0 < 3.6.1 | 3.6.1 |
CVSS provenance
nvdv3.14.0MEDIUMCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
osv6.1MEDIUM
vendor_ubuntu6.1MEDIUM
vendor_debian4.0MEDIUM
vendor_redhat4.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
openssl, openssl1.0 vulnerabilities
osv·2026-01-27·CVSS 6.1
CVE-2025-68160 [MEDIUM] openssl, openssl1.0 vulnerabilities
openssl, openssl1.0 vulnerabilities
USN-7980-2 fixed vulnerabilities in OpenSSL. This update provides the
corresponding updates for CVE-2025-68160 for openssl and openssl1.0,
CVE-2025-69418 for openssl on Ubuntu 18.04 LTS and Ubuntu 20.04 LTS,
CVE-2025-69419 for openssl on Ubuntu 18.04 LTS and Ubuntu 20.04 LTS,
CVE-2025-69420 for openssl on Ubuntu 18.04 LTS and Ubuntu 20.04 LTS,
CVE-2025-69421 for openssl and openssl1.0, CVE-2026-22795 for openssl on
Ubuntu 18.04 LTS and Ubuntu 20.04 LTS, and CVE-2026-22796 for openssl and
openssl1.0.
Original advisory details:
Stanislav Fort, Petr Šimeček, and Hamza discovered that OpenSSL
incorrectly validated PBMAC1 parameters when doing PKCS#12 MAC
verification. An attacker could possibly use this issue to cause OpenSSL
to crash, resulting in a deni
GHSA
GHSA-78qr-24v5-7q73: Issue summary: When using the low-level OCB API directly with AES-NI orother hardware-accelerated code paths, inputs whose length is not a multipleof
ghsa_unreviewed·2026-01-27
CVE-2025-69418 [MEDIUM] CWE-325 GHSA-78qr-24v5-7q73: Issue summary: When using the low-level OCB API directly with AES-NI orother hardware-accelerated code paths, inputs whose length is not a multipleof
Issue summary: When using the low-level OCB API directly with AES-NI orother hardware-accelerated code paths, inputs whose length is not a multipleof 16 bytes can leave the final partial block unencrypted and unauthenticated.Impact summary: The trailing 1-15 bytes of a message may be exposed incleartext on encryption and are not covered by the authentication tag,allowing an attacker to read or tamper with those bytes without detection.The low-level OCB encrypt and decrypt routines in the hardware-acceleratedstream path process full 16-byte blocks but do not advance the input/outputpointers. The subsequent tail-handling code then operates on the originalbase pointers, effectively reprocessing the beginning of the buffer whileleaving the actual trailing bytes unprocessed. The authentication
OSV
openssl vulnerabilities
osv·2026-01-27·CVSS 6.1
CVE-2025-11187 [MEDIUM] openssl vulnerabilities
openssl vulnerabilities
Stanislav Fort, Petr Šimeček, and Hamza discovered that OpenSSL
incorrectly validated PBMAC1 parameters when doing PKCS#12 MAC
verification. An attacker could possibly use this issue to cause OpenSSL to
crash, resulting in a denial of service. This issue only affected Ubuntu
25.10. (CVE-2025-11187)
Stanislav Fort discovered that OpenSSL incorrectly parsed CMS
AuthEnvelopedData messages. An attacker could possibly use this issue to
cause OpenSSL to crash, resulting in a denial of service. (CVE-2025-15467)
Stanislav Fort discovered that OpenSSL incorrectly handled memory in the
SSL_CIPHER_find() function. An attacker could possibly use this issue to
cause OpenSSL to crash, resulting in a denial of service. This issue only
affected Ubuntu 25.10. (CVE-2025-15468)
St
OSV
CVE-2025-69418: Issue summary: When using the low-level OCB API directly with AES-NI orother hardware-accelerated code paths, inputs whose length is not a multipleof
osv·2026-01-27·CVSS 4.0
CVE-2025-69418 [MEDIUM] CVE-2025-69418: Issue summary: When using the low-level OCB API directly with AES-NI orother hardware-accelerated code paths, inputs whose length is not a multipleof
Issue summary: When using the low-level OCB API directly with AES-NI orother hardware-accelerated code paths, inputs whose length is not a multipleof 16 bytes can leave the final partial block unencrypted and unauthenticated.Impact summary: The trailing 1-15 bytes of a message may be exposed incleartext on encryption and are not covered by the authentication tag,allowing an attacker to read or tamper with those bytes without detection.The low-level OCB encrypt and decrypt routines in the hardware-acceleratedstream path process full 16-byte blocks but do not advance the input/outputpointers. The subsequent tail-handling code then operates on the originalbase pointers, effectively reprocessing the beginning of the buffer whileleaving the actual trailing bytes unprocessed. The authentication
Red Hat
openssl: OpenSSL: Information disclosure and data tampering via specific low-level OCB encryption/decryption calls
vendor_redhat·2026-01-27·CVSS 4.0
CVE-2025-69418 [MEDIUM] CWE-325 openssl: OpenSSL: Information disclosure and data tampering via specific low-level OCB encryption/decryption calls
openssl: OpenSSL: Information disclosure and data tampering via specific low-level OCB encryption/decryption calls
Issue summary: When using the low-level OCB API directly with AES-NI orother hardware-accelerated code paths, inputs whose length is not a multipleof 16 bytes can leave the final partial block unencrypted and unauthenticated.Impact summary: The trailing 1-15 bytes of a message may be exposed incleartext on encryption and are not covered by the authentication tag,allowing an attacker to read or tamper with those bytes without detection.The low-level OCB encrypt and decrypt routines in the hardware-acceleratedstream path process full 16-byte blocks but do not advance the input/outputpointers. The subsequent tail-handling code then operates on the originalbase pointers, effectiv
Ubuntu
OpenSSL vulnerabilities
vendor_ubuntu·2026-01-27·CVSS 6.1
CVE-2025-69419 [MEDIUM] OpenSSL vulnerabilities
Title: OpenSSL vulnerabilities
Summary: Several security issues were fixed in OpenSSL.
USN-7980-1 fixed vulnerabilities in OpenSSL. This update provides the
corresponding updates for CVE-2025-68160 for openssl and openssl1.0,
CVE-2025-69418 for openssl on Ubuntu 18.04 LTS and Ubuntu 20.04 LTS,
CVE-2025-69419 for openssl on Ubuntu 18.04 LTS and Ubuntu 20.04 LTS,
CVE-2025-69420 for openssl on Ubuntu 18.04 LTS and Ubuntu 20.04 LTS,
CVE-2025-69421 for openssl and openssl1.0, CVE-2026-22795 for openssl on
Ubuntu 18.04 LTS and Ubuntu 20.04 LTS, and CVE-2026-22796 for openssl and
openssl1.0.
Original advisory details:
Stanislav Fort, Petr Šimeček, and Hamza discovered that OpenSSL
incorrectly validated PBMAC1 parameters when doing PKCS#12 MAC
verification. An attacker could possibly use this
BSD
FreeBSD-SA-26:01.openssl: Multiple vulnerabilities in OpenSSL
bsd_advisories·2026-01-27·CVSS 6.1
CVE-2025-11187 [MEDIUM] FreeBSD-SA-26:01.openssl: Multiple vulnerabilities in OpenSSL
FreeBSD-SA-26:01.openssl Security Advisory
The FreeBSD Project
Topic: Multiple vulnerabilities in OpenSSL
Category: contrib
Module: openssl
Announced: 2026-01-27
Credits: Aisle Research
Affects: All supported versions of FreeBSD.
Corrected: 2026-01-27 19:14:58 UTC (stable/15, 15.0-STABLE)
2026-01-27 19:15:49 UTC (releng/15.0, 15.0-RELEASE-p2)
2026-01-27 19:15:10 UTC (stable/14, 14.3-STABLE)
2026-01-27 19:16:22 UTC (releng/14.3, 14.3-RELEASE-p8)
2026-01-27 19:15:19 UTC (stable/13, 13.4-STABLE)
2026-01-27 19:16:45 UTC (releng/13.5, 13.5-RELEASE-p9)
CVE Name: CVE-2025-11187, CVE-2025-15467, CVE-2025-15468,
CVE-2025-15469, CVE-2025-66199, CVE-2025-68160,
CVE-2025-69418, CVE-2025-69419, CVE-2025-69420,
CVE-2025-69421, CVE-2026-22795, CVE-2026-22796
For general information regarding FreeBSD S
Ubuntu
OpenSSL vulnerabilities
vendor_ubuntu·2026-01-27·CVSS 6.1
CVE-2025-66199 [MEDIUM] OpenSSL vulnerabilities
Title: OpenSSL vulnerabilities
Summary: Several security issues were fixed in OpenSSL.
Stanislav Fort, Petr Šimeček, and Hamza discovered that OpenSSL
incorrectly validated PBMAC1 parameters when doing PKCS#12 MAC
verification. An attacker could possibly use this issue to cause OpenSSL to
crash, resulting in a denial of service. This issue only affected Ubuntu
25.10. (CVE-2025-11187)
Stanislav Fort discovered that OpenSSL incorrectly parsed CMS
AuthEnvelopedData messages. An attacker could possibly use this issue to
cause OpenSSL to crash, resulting in a denial of service. (CVE-2025-15467)
Stanislav Fort discovered that OpenSSL incorrectly handled memory in the
SSL_CIPHER_find() function. An attacker could possibly use this issue to
cause OpenSSL to crash, resulting in a denial of serv
Debian
CVE-2025-69418: openssl - Issue summary: When using the low-level OCB API directly with AES-NI or<br>other...
vendor_debian·2025·CVSS 4.0
CVE-2025-69418 [MEDIUM] CVE-2025-69418: openssl - Issue summary: When using the low-level OCB API directly with AES-NI or<br>other...
Issue summary: When using the low-level OCB API directly with AES-NI orother hardware-accelerated code paths, inputs whose length is not a multipleof 16 bytes can leave the final partial block unencrypted and unauthenticated.Impact summary: The trailing 1-15 bytes of a message may be exposed incleartext on encryption and are not covered by the authentication tag,allowing an attacker to read or tamper with those bytes without detection.The low-level OCB encrypt and decrypt routines in the hardware-acceleratedstream path process full 16-byte blocks but do not advance the input/outputpointers. The subsequent tail-handling code then operates on the originalbase pointers, effectively reprocessing the beginning of the buffer whileleaving the actual trailing bytes unprocessed. The authentication
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2025-69418 openssl: OpenSSL: Information disclosure and data tampering via specific low-level OCB encryption/decryption calls
bugzilla·2026-01-16·CVSS 4.0
CVE-2025-69418 [MEDIUM] CVE-2025-69418 openssl: OpenSSL: Information disclosure and data tampering via specific low-level OCB encryption/decryption calls
CVE-2025-69418 openssl: OpenSSL: Information disclosure and data tampering via specific low-level OCB encryption/decryption calls
The trailing 1-15 bytes of a message may be exposed in
cleartext on encryption and are not covered by the authentication tag,
allowing an attacker to read or tamper with those bytes without detection.
The low-level OCB encrypt and decrypt routines in the hardware-accelerated
stream path process full 16-byte blocks but do not advance the input/output
pointers. The subsequent tail-handling code then operates on the original
base pointers, effectively reprocessing the beginning of the buffer while
leaving the actual trailing bytes unprocessed. The authentication checksum
also excludes the true tail bytes.
However, typical OpenSSL consumers using EVP are not affe
Wiz
CVE-2025-69418 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 4.0
CVE-2025-69418 [MEDIUM] CVE-2025-69418 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-69418 :
Node.js vulnerability analysis and mitigation
Issue summary: When using the low-level OCB API directly with AES-NI or
other hardware-accelerated code paths, inputs whose length is not a multiple
of 16 bytes can leave the final partial block unencrypted and unauthenticated.
Impact summary: The trailing 1-15 bytes of a message may be exposed in
cleartext on encryption and are not covered by the authentication tag,
allowing an attacker to read or tamper with those bytes without detection.
The low-level OCB encrypt and decrypt routines in the hardware-accelerated
stream path process full 16-byte blocks but do not advance the input/output
pointers. The subsequent tail-handling code then operates on the original
base pointers, effectively reprocessing the beginning of the
https://github.com/openssl/openssl/commit/372fc5c77529695b05b4f5b5187691a57ef5dffchttps://github.com/openssl/openssl/commit/4016975d4469cd6b94927c607f7c511385f928d8https://github.com/openssl/openssl/commit/52d23c86a54adab5ee9f80e48b242b52c4cc2347https://github.com/openssl/openssl/commit/a7589230356d908c0eca4b969ec4f62106f4f5aehttps://github.com/openssl/openssl/commit/ed40856d7d4ba6cb42779b6770666a65f19cb977https://openssl-library.org/news/secadv/20260127.txthttps://cert-portal.siemens.com/productcert/html/ssa-265688.html
2026-01-27
Published