OpenSSL low-level OCB trailing bytes left unencrypted and unauthenticated

CVE-2025-69418 is a flaw in OpenSSL's low-level OCB implementation affecting hardware-accelerated code paths such as AES-NI when applications call CRYPTO_ocb128_encrypt() or CRYPTO_ocb128_decrypt() directly with input lengths that are not a multiple of 16 bytes in a single call. In the vulnerable stream path, full 16-byte blocks are processed but the input/output pointers are not advanced correctly. The subsequent tail-handling logic then operates on the original base pointers instead of the true trailing partial block. As a result, the actual final 1 to 15 bytes of the message may remain unencrypted during encryption and are excluded from the OCB authentication checksum/tag computation. The issue affects OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, and 1.1.1. OpenSSL 1.0.2 is not affected. Typical consumers using the EVP API are not affected because EVP/provider OCB implementations split full blocks and partial tails into separate calls, avoiding the vulnerable path. TLS is also not affected because it does not use OCB ciphersuites. FIPS modules in 3.0 through 3.6 are not affected because OCB is not FIPS-approved and is outside those module boundaries.