CVE-2025-68160
Medium · 4.7CVSS
4.7
EPSS
0.2%
Published
Jan 27, 2026
CISA due date
—
The record
Issue summary: Writing large, newline-free data into a BIO chain using the line-buffering filter where the next BIO performs short writes can trigger a heap-based out-of-bounds write. Impact summary: This out-of-bounds write can cause memory corruption which typically results in a crash, leading to Denial of Service for an application. The line-buffering BIO filter (BIO_f_linebuffer) is not used by default in TLS/SSL data paths. In OpenSSL command-line applications, it is typically only pushed onto stdout/stderr on VMS systems. Third-party applications that explicitly use this filter with a BIO chain that can short-write and that write large, newline-free data influenced by an attacker would be affected. However, the circumstances where this could happen are unlikely to be under attacker control, and BIO_f_linebuffer is unlikely to be handling non-curated data controlled by an attacker. For that reason the issue was assessed as Low severity. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the BIO implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| AlmaLinux:10 | openssl | 0 | 1:3.5.1-7.el10_1.alma.1 |
| AlmaLinux:10 | openssl-devel | 0 | 1:3.5.1-7.el10_1.alma.1 |
| AlmaLinux:10 | openssl-libs | 0 | 1:3.5.1-7.el10_1.alma.1 |
| AlmaLinux:10 | openssl-perl | 0 | 1:3.5.1-7.el10_1.alma.1 |
| Chainguard | libcrypto3-2.34 | 0 | 3.6.1-r0 |
| Chainguard | openssl | 0 | 3.6.1-r0 |
| Chainguard | openssl-provider-fips | 0 | 0 |
| Chainguard | openssl-provider-fips-3.1.2 | 0 | 0 |
| Chainguard | openssl-provider-fips-3.4.0 | 0 | 0 |
| Chainguard | openssl-provider-fips-3.4.0 | 0 | 3.4.0-r4 |
| Chainguard | openssl-provider-fips-3.6.0 | 0 | 0 |
| Chainguard | openssl-provider-fips-3.6.0 | 0 | 3.6.0-r2 |
| Mageia:9 | openssl | 0 | 3.0.19-1.mga9 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | openssl-1_0_0 | 0 | 1.0.2p-150000.3.102.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | openssl-3 | 0 | 3.0.8-150400.4.78.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | openssl-1_0_0 | 0 | 1.0.2p-150000.3.102.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | openssl-3 | 0 | 3.0.8-150400.4.78.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | openssl-3 | 0 | 3.0.8-150500.5.57.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | openssl-3 | 0 | 3.0.8-150500.5.57.1 |
| SUSE:Linux Enterprise Micro 5.3 | openssl-3 | 0 | 3.0.8-150400.4.78.1 |
| SUSE:Linux Enterprise Micro 5.4 | openssl-3 | 0 | 3.0.8-150400.4.78.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | openssl-3 | 0 | 3.2.3-150700.5.24.1 |
| SUSE:Linux Enterprise Module for Legacy 15 SP7 | openssl-1_0_0 | 0 | 1.0.2p-150000.3.102.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | openssl-1_0_0 | 0 | 1.0.2p-150000.3.102.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | openssl-3 | 0 | 3.0.8-150400.4.78.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | openssl-1_0_0 | 0 | 1.0.2p-150000.3.102.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | openssl-3 | 0 | 3.0.8-150500.5.57.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | openssl-1_0_0 | 0 | 1.0.2p-150000.3.102.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | openssl-1_1 | 0 | 1.1.1w-150600.5.21.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | openssl-3 | 0 | 3.1.4-150600.5.42.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | openssl-1_0_0 | 0 | 1.0.2p-150000.3.102.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | openssl-3 | 0 | 3.0.8-150400.4.78.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | openssl-1_0_0 | 0 | 1.0.2p-150000.3.102.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | openssl-3 | 0 | 3.0.8-150500.5.57.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | openssl-1_0_0 | 0 | 1.0.2p-150000.3.102.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | openssl-1_1 | 0 | 1.1.1w-150600.5.21.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | openssl-3 | 0 | 3.1.4-150600.5.42.1 |
| Wolfi | openssl | 0 | 3.6.1-r0 |
| openSUSE:Leap 15.6 | openssl-1_0_0 | 0 | 1.0.2p-150000.3.102.1 |
| openSUSE:Leap 15.6 | openssl-1_1 | 0 | 1.1.1w-150600.5.21.1 |
| openSUSE:Leap 15.6 | openssl-3 | 0 | 3.1.4-150600.5.42.1 |
| openSUSE:Leap 16.0 | openssl-3 | 0 | 3.5.0-160000.5.1 |
| openSUSE:Tumbleweed | openssl-3 | 0 | 3.5.3-2.1 |
Related vulnerabilities
- CVE-2026-22795 Issue summary: An invalid or NULL pointer dereference can happen in an application… Also affects openssl
- CVE-2026-22796 Issue summary: A type confusion vulnerability exists in the signature verification of… Also affects openssl
- CVE-2025-69419 Issue summary: Calling PKCS12_get_friendlyname() function on a maliciously crafted… Also affects openssl
- CVE-2025-69420 Issue summary: A type confusion vulnerability exists in the TimeStamp Response… Also affects openssl
- CVE-2025-69421 Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer dereference… Also affects openssl
- CVE-2025-69418 Issue summary: When using the low-level OCB API directly with AES-NI orother… Also affects openssl
- CVE-2025-66199 Issue summary: A TLS 1.3 connection using certificate compression can be forced to… Also affects openssl
- CVE-2025-11187 Issue summary: PBMAC1 parameters in PKCS#12 files are missing validation which can… Also affects openssl