--- id: CVE-2025-69418 title: Unauthenticated/unencrypted trailing bytes with low-level OCB function calls summary: >- Issue summary: When using the low-level OCB API directly with AES-NI or
other hardware-accelerated code paths, inputs whose length is not a multiple
of 16 bytes can leave the final partial block unencrypted and unauthenticated.
… severity: medium cvss: 4 cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N' cvssSource: adp cwe: - CWE-325 vendor: OpenSSL product: OpenSSL affected: - OpenSSL >= 3.6.0 < 3.6.1 - OpenSSL >= 3.5.0 < 3.5.5 - OpenSSL >= 3.4.0 < 3.4.4 - OpenSSL >= 3.3.0 < 3.3.6 - OpenSSL >= 3.0.0 < 3.0.19 - OpenSSL >= 1.1.1 < 1.1.1ze ssvc: exploitation: none automatable: 'no' technicalImpact: partial timestamp: '2026-01-29T15:06:43.617751Z' published: '2026-01-27' updated: '2026-10-15' sourceUpdated: '2026-10-15T01:10:25.604Z' source: CVEORG sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-69418' references: - url: 'https://openssl-library.org/news/secadv/20260127.txt' label: OpenSSL Advisory - url: >- https://github.com/openssl/openssl/commit/ed40856d7d4ba6cb42779b6770666a65f19cb977 label: 3.6.1 git commit - url: >- https://github.com/openssl/openssl/commit/4016975d4469cd6b94927c607f7c511385f928d8 label: 3.5.5 git commit - url: >- https://github.com/openssl/openssl/commit/372fc5c77529695b05b4f5b5187691a57ef5dffc label: 3.4.4 git commit - url: >- https://github.com/openssl/openssl/commit/a7589230356d908c0eca4b969ec4f62106f4f5ae label: 3.3.6 git commit - url: >- https://github.com/openssl/openssl/commit/52d23c86a54adab5ee9f80e48b242b52c4cc2347 label: 3.0.19 git commit tags: - cve.org epss: 0.00129 epssPercentile: 0.02287 ingestedAt: '2026-10-15T05:52:46.060Z' --- ## Overview Issue summary: When using the low-level OCB API directly with AES-NI or
other hardware-accelerated code paths, inputs whose length is not a multiple
of 16 bytes can leave the final partial block unencrypted and unauthenticated.

Impact summary: The trailing 1-15 bytes of a message may be exposed in
cleartext on encryption and are not covered by the authentication tag,
allowing an attacker to read or tamper with those bytes without detection.

The low-level OCB encrypt and decrypt routines in the hardware-accelerated
stream path process full 16-byte blocks but do not advance the input/output
pointers. The subsequent tail-handling code then operates on the original
base pointers, effectively reprocessing the beginning of the buffer while
leaving the actual trailing bytes unprocessed. The authentication checksum
also excludes the true tail bytes.

However, typical OpenSSL consumers using EVP are not affected because the
higher-level EVP and provider OCB implementations split inputs so that full
blocks and trailing partial blocks are processed in separate calls, avoiding
the problematic code path. Additionally, TLS does not use OCB ciphersuites.
The vulnerability only affects applications that call the low-level
CRYPTO_ocb128_encrypt() or CRYPTO_ocb128_decrypt() functions directly with
non-block-aligned lengths in a single call on hardware-accelerated builds.
For these reasons the issue was assessed as Low severity.

The FIPS modules in 3.6, 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected
by this issue, as OCB mode is not a FIPS-approved algorithm.

OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.

OpenSSL 1.0.2 is not affected by this issue. ## Affected - `OpenSSL >= 3.6.0 < 3.6.1` - `OpenSSL >= 3.5.0 < 3.5.5` - `OpenSSL >= 3.4.0 < 3.4.4` - `OpenSSL >= 3.3.0 < 3.3.6` - `OpenSSL >= 3.0.0 < 3.0.19` - `OpenSSL >= 1.1.1 < 1.1.1ze` ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges.