CVE-2014-0160: OpenSSL TLS/DTLS Heartbeat Extension Out-of-Bounds Read (Heartbleed)

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated remote memory disclosure with near-certain exploitation (EPSS 0.99999) and CISA KEV listing, allowing private key and credential theft.

What it is

OpenSSL 1.0.1 before 1.0.1g mishandles Heartbeat Extension packets in its TLS and DTLS implementations, causing an out-of-bounds read of process memory. A remote attacker can read up to 64KB of adjacent memory per crafted request, which may include private keys, session data, and credentials. The flaw is trivially reachable over the network and is one of the most widely exploited information disclosure bugs ever disclosed.

Impact

An unauthenticated attacker gains read access to server process memory, potentially recovering private keys, session tokens, and user credentials. Recovered private keys allow decryption of past and future TLS traffic and enable impersonation of the affected service.

Attack surface

Reachable over the network via a crafted TLS or DTLS Heartbeat request to any service using a vulnerable OpenSSL build; no authentication or user interaction is required per the CVSS vector AV:N/AC:L/PR:N/UI:N. Any exposed TLS endpoint (HTTPS, SMTP, IMAP, VPN, embedded devices) is a candidate.

Exploitation

CVE-2014-0160 is listed in CISA KEV (added 2022-05-04) and has an EPSS 30-day probability of 0.99999 (percentile 0.99997), indicating near-certain exploitation activity. No ransomware campaign use is documented in the record.

What to do

• Upgrade OpenSSL to 1.0.1g or later, or apply the vendor-supplied patch for your distribution or product.
• If patching is not immediately possible, recompile OpenSSL with -DOPENSSL_NO_HEARTBEATS to disable the Heartbeat extension.
• After patching, reissue TLS certificates and revoke old ones, and rotate any credentials or session keys that may have been exposed.
• Inventory all internet-facing and embedded TLS services (including the listed vendors such as Siemens, Mitel, FileZilla Server, Splunk, and Broadcom products) and confirm each is on a fixed version.
• Restrict or monitor external access to TLS endpoints until remediation is verified.

Detection

• Inspect TLS/DTLS traffic for Heartbeat requests with payload lengths exceeding the actual data, which is the signature of the over-read.
• Monitor IDS/IPS signatures for CVE-2014-0160 and alert on repeated heartbeat anomalies from a single source.
• Review server and TLS logs for unexpected memory disclosure indicators or unusual heartbeat traffic patterns.
• Scan internal and external assets for vulnerable OpenSSL versions and flag any host still running 1.0.1 before 1.0.1g.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.