CVE-2025-68160: 
OpenSSL vulnerability analysis and mitigation

CVE-2025-68160 is a heap-based out-of-bounds write vulnerability in OpenSSL's line-buffering BIO filter (BIO_f_linebuffer). It is triggered when large, newline-free data is written into a BIO chain where the next BIO performs short writes, causing the remainder of the unwritten buffer to be copied unconditionally into an insufficiently sized internal buffer (ctx->obuf). The vulnerability was disclosed on January 27, 2026, and affects OpenSSL versions 1.0.2 (before 1.0.2zn), 1.1.1 (before 1.1.1ze), 3.0.x (before 3.0.19), 3.3.x (before 3.3.6), 3.4.x (before 3.4.4), 3.5.x (before 3.5.5), and 3.6.x (before 3.6.1). It carries a CVSS v3.1 base score of 4.7 (Medium) (OpenSSL Advisory, Red Hat CVE).

The root cause is classified as CWE-787 (Out-of-bounds Write). In the linebuffer_write function within crypto/bio/bf_lbuf.c, when data without a newline character remains after processing, the code unconditionally copies the remainder into the internal output buffer ctx->obuf without checking whether sufficient space is available. If the next BIO in the chain performs a short write, the buffer can overflow. The fix modifies the logic to check available space before copying and flushes buffered data to the next BIO to free space when needed (OpenSSL Commit). Exploitation requires: (1) an application explicitly using BIO_f_linebuffer, (2) a BIO chain where the next BIO can perform short writes, and (3) large, newline-free attacker-influenced data being written through the filter. The filter is not used in default TLS/SSL data paths and is primarily found on VMS systems in OpenSSL CLI tools (OpenSSL Advisory).

Successful exploitation causes heap memory corruption, which typically results in an application crash and Denial of Service (DoS). There is no known confidentiality or integrity impact — the primary risk is availability loss for applications that explicitly use BIO_f_linebuffer with attacker-influenced data. The FIPS modules in OpenSSL 3.0, 3.3, 3.4, 3.5, and 3.6 are not affected, as the BIO implementation lies outside the FIPS module boundary. Downstream products from IBM (InfoSphere Information Server, API Connect, Netezza Appliance, watsonx Orchestrate, Instana Observability), Dell, Splunk, and others that bundle vulnerable OpenSSL versions are also affected (OpenSSL Advisory, Red Hat CVE).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Red Hat CVE). The EPSS score is approximately 0.026%, reflecting very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is further constrained by the requirement that the target application must explicitly use BIO_f_linebuffer with attacker-controlled, newline-free data — a combination considered unlikely in typical production environments (OpenSSL Advisory).

OpenSSL has released patched versions addressing this vulnerability across all affected branches:

• OpenSSL 1.0.2: Update to 1.0.2zn or later
• OpenSSL 1.1.1: Update to 1.1.1ze or later
• OpenSSL 3.0.x: Update to 3.0.19 or later
• OpenSSL 3.3.x: Update to 3.3.6 or later
• OpenSSL 3.4.x: Update to 3.4.4 or later
• OpenSSL 3.5.x: Update to 3.5.5 or later
• OpenSSL 3.6.x: Update to 3.6.1 or later

As a workaround, review applications for explicit use of BIO_f_linebuffer; if not required, avoid pushing this filter onto BIO chains. Prioritize patching for applications that handle untrusted, non-curated data through this filter. FIPS-mode deployments are not affected by this issue (OpenSSL Advisory, OpenSSL Commit).

The vulnerability was part of a batch of 12 OpenSSL security issues disclosed on January 27, 2026, which attracted notable attention due to an AI-assisted security research team (Aisle) claiming discovery of all 12 vulnerabilities — prompting coverage from Tom's Hardware, TechRadar, Heise, and LessWrong discussing the role of AI in vulnerability research (Tom's Hardware, TechRadar). CVE-2025-68160 itself was assessed as Low severity by OpenSSL due to the narrow exploitation conditions, and the OpenSSL project and community mailing lists confirmed the limited real-world risk (OpenSSL Users Group). Downstream vendors including Red Hat, SUSE, Debian, Ubuntu, FreeBSD, Alpine, Fedora, and IBM issued their own advisories and patches shortly after the disclosure.