CVE-2026-45445: OpenSSL AES-OCB IV Discard and Tag Forgery Vulnerability

Technical summary

The vulnerability stems from inconsistent IV handling between OpenSSL's streaming and one-shot cipher APIs. When EVP_Cipher() is called on an AES-OCB context, the application-supplied IV is not flushed into the OCB cipher state before processing, leaving it in the all-zero state initialized by the provider. This results in (key, nonce) reuse across all invocations using the same key. If EVP_EncryptFinal_ex() is subsequently called to obtain the authentication tag, the deferred IV setup clears the accumulated plaintext checksum, causing the tag to depend only on the (key, IV) pair rather than the actual data. An attacker observing a single (ciphertext, tag) pair can forge valid tags for any ciphertext under the same key and IV. The OpenSSL FIPS modules and the SSL/TLS implementation are unaffected, as they do not use EVP_Cipher() with AES-OCB or support it as a cipher suite.

Business impact

Organizations using OpenSSL-based applications that encrypt sensitive data with AES-OCB via the EVP_Cipher() one-shot interface face exposure of encrypted payloads and risk of message forgery. An attacker who captures encrypted traffic or stored ciphertexts can derive plaintext through standard cryptanalysis and create counterfeit messages that pass authentication. This undermines both confidentiality and integrity guarantees for affected systems. However, the practical scope is narrower than it initially appears: most applications rely on the recommended streaming API or established TLS implementations, limiting the affected population. Still, any in-house or third-party cryptographic integration using AES-OCB with the one-shot interface is at immediate risk and requires urgent review and remediation.

Affected systems

OpenSSL versions using the AES-OCB provider are affected when EVP_Cipher() is the application's chosen interface. The FIPS modules in versions 4.0, 3.6, 3.5, 3.4, and 3.0 are explicitly not affected. TLS implementations and applications using the documented EVP_CipherUpdate() / EVP_CipherFinal_ex() streaming interface are unaffected. Organizations should audit their codebase for direct calls to EVP_Cipher() in combination with AES-OCB cipher names ('aes-*-ocb' in provider strings). Third-party libraries or custom AEAD implementations relying on this pattern are the primary concern.

Exploitability

Exploitation requires an attacker to observe encrypted messages or access stored ciphertexts produced by the vulnerable code path. No network-level interaction or authentication is needed; the vulnerability manifests purely through the cryptographic properties of the cipher state. Once a single (ciphertext, tag) pair is obtained, an attacker can cryptanalytically recover plaintext and forge arbitrary messages under the same key-IV pair. The attack is deterministic and does not require guessing or brute-force. However, real-world exploitation hinges on an application actually using EVP_Cipher() with AES-OCB, which is contrary to OpenSSL's own documented recommendations, making the vulnerable use pattern relatively uncommon but not unheard of in custom or legacy integrations.

Remediation

Affected applications must upgrade to a patched OpenSSL version once released and immediately audit their ciphertext API usage. The primary mitigation is to migrate from EVP_Cipher() to the recommended EVP_CipherUpdate() / EVP_CipherFinal_ex() streaming interface for all AEAD operations, including AES-OCB. If immediate patching is not possible, consider disabling AES-OCB as a cipher option and substituting a different authenticated encryption scheme. Any ciphertexts or authentication tags produced by vulnerable code paths should be considered compromised and regenerated after patching. For data that was encrypted with the vulnerable code, a retrospective cryptographic risk assessment is needed to determine if re-encryption is warranted.

Patch guidance

Monitor OpenSSL's official releases and security advisories for patched versions addressing CVE-2026-45445. Verify patch availability through the OpenSSL website and your distribution's security announcements before deploying. When patching, replace the entire OpenSSL library to ensure both libcrypto (where the provider lives) and any dependent applications are updated in tandem. Test the patched version thoroughly in a staging environment, particularly any custom AEAD code paths, to confirm the IV is now correctly applied. Applications running on distributions with extended support (e.g., Red Hat, Ubuntu LTS) should expect vendor-provided patches aligned with their release cycles.

Detection guidance

Search your codebase for calls to EVP_Cipher() paired with AES-OCB cipher names (e.g., 'aes-256-ocb', 'aes-128-ocb'). Use static analysis tools to flag these patterns as high-priority findings. For deployed systems, enable logging of any cipher operations and review logs for instances of OCB cipher invocations via the one-shot API. Monitor OpenSSL version numbers in running processes; any version prior to the patch announcement is suspect if AES-OCB is in use. Network-based detection is difficult without plaintext visibility, but unexplained authentication tag mismatches or unexpected message acceptance could signal exploitation. Implement integrity monitoring on systems where encrypted data is both generated and verified locally.

Why prioritize this

This vulnerability merits immediate attention due to its HIGH CVSS score (7.5) and the complete loss of confidentiality and integrity for affected data. The attack requires no user interaction, no privilege escalation, and no authentication. However, the practical attack surface is constrained by the rarity of EVP_Cipher() usage with AES-OCB in production; most real-world OpenSSL deployments do not follow this anti-pattern. Organizations should prioritize this as urgent only if they have confirmed use of the vulnerable API combination; broader deployments can treat it as high-priority but not critical. The long timeline before active public exploitation (if it occurs) allows for orderly patching.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a network-exploitable vulnerability with high impact on confidentiality but no direct impact on availability or integrity in the traditional sense. The score does not discount for the uncommon use pattern (EVP_Cipher() with AES-OCB), which would be a mitigating factor in practice. The score correctly emphasizes that any application using this combination faces complete loss of encryption security. Contextually, your organization's risk depends heavily on whether you actually deploy this specific API pattern; if you don't, the vulnerability is a non-issue for you, while for those who do, the risk is severe.

Frequently asked questions