The flaw originates in OpenSSL's provider implementation of AES‑SIV and AES‑GCM‑SIV. When a decryption context receives AAD but no ciphertext update, the library preserves an all‑zeros authentication tag rather than recomputing it. An attacker can therefore transmit a message containing arbitrary AAD, an empty ciphertext, and a zero‑tag; the decryption routine will accept the message and return success, violating the integrity guarantees of these AEAD modes. The vulnerability confines itself to messages that omit any ciphertext bytes; it does not require knowledge of the encryption key to succeed for AES‑GCM‑SIV, and for AES‑SIV it requires the application to reuse a decryption context without resetting the key. The result is the ability to forge empty messages with any chosen additional authenticated data.

This issue affects the OpenSSL provider layers of AES‑SIV (introduced in OpenSSL 3.0) and AES‑GCM‑SIV (introduced in OpenSSL 3.2). The FIPS modules, covering OpenSSL 4.0, 3.6, 3.5, 3.4, and 3.0, are not impacted because the vulnerable code lies outside the FIPS boundary. No OpenSSL‑internally defined protocols (TLS, CMS, PKCS#7, HPKE, QUIC) use these ciphers, so the flaw only affects applications that implement their own protocols and call the EVP interface directly. When such applications allow an empty ciphertext to be processed, they become susceptible to forgery.

EPSS information is unavailable and the flaw is not listed in CISA’s KEV catalog, suggesting no confirmed widespread exploitation. Nevertheless, if an application in the wild accepts empty ciphertexts and passes them directly to EVP_DecryptFinal_ex, an attacker can craft a forged message that the application will treat as authentic. The attack requires sending a message consisting of AAD, an empty ciphertext, and a zero tag; the flow must match the described decryption path for the forgery to succeed. The risk level is therefore contingent on how broadly the affected ciphers are used in client code, but the potential impact is high because the attacker can impersonate legitimate messages without knowing the encryption key.