What is the CVSS score of CVE-2026-34054?

CVE-2026-34054 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of OpenSSL are affected by CVE-2026-34054?

CVE-2026-34054 is a local privilege escalation vulnerability in vcpkg versions prior to 3.6.1#3 that allows low-privileged Windows users to gain full system control through a hardcoded build path in…. A patch is available.

How to fix or mitigate CVE-2026-34054?

Within 24 hours: Inventory all systems running vcpkg and identify instances prior to version 3.6.1#3. Within 7 days: Apply vendor-released patch by upgrading to vcpkg version 3.6.1#3 or later on all Windows development and build systems. Within 30 days: Verify patch deployment across all environments via automated scanning and audit vcpkg-managed OpenSSL binaries for configuration compliance.

OpenSSL CVE-2026-34054

EUVD-2026-17285 HIGH

Uncontrolled Search Path Element (CWE-427)

2026-03-31 GitHub_M

OpenSSL Microsoft Information Disclosure

7.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:10 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

3.6.1

EUVD ID Assigned

Mar 31, 2026 - 02:30 euvd

EUVD-2026-17285

Analysis Generated

Mar 31, 2026 - 02:30 vuln.today

CVE Published

Mar 31, 2026 - 01:56 nvd

HIGH 7.8

DescriptionGitHub Advisory

vcpkg is a free and open-source C/C++ package manager. Prior to version 3.6.1#3, vcpkg's Windows builds of OpenSSL set openssldir to a path on the build machine, making that path be attackable later on customer machines. This issue has been patched in version 3.6.1#3.

AnalysisAI

Local privilege escalation via hardcoded build path in vcpkg's OpenSSL binaries affects Windows users of the C/C++ package manager prior to version 3.6.1#3. The vulnerability allows authenticated local attackers with low privileges to achieve high confidentiality, integrity, and availability impact (CVSS 7.8) by exploiting the hardcoded openssldir path that references the original build machine. Upstream fix available (PR #50518, commit 5111afd); patched version 3.6.1#3 released. No public exploit identified at time of analysis, with EPSS data not available for this recent CVE.

Technical ContextAI

vcpkg is Microsoft's cross-platform C/C++ dependency manager that builds libraries from source. The vulnerability stems from CWE-427 (Uncontrolled Search Path Element) in how vcpkg configured OpenSSL builds for Windows. When vcpkg compiled OpenSSL on Windows, it embedded the build machine's filesystem path as the openssldir configuration parameter within the resulting OpenSSL binaries. This hardcoded path creates a search path vulnerability on customer machines: if an attacker can create or control files at that specific path on a target system, they can manipulate OpenSSL's runtime behavior (certificate stores, configuration files, engine modules) to execute malicious code or intercept cryptographic operations. This affects any Windows application using OpenSSL binaries distributed via vcpkg versions before 3.6.1#3, as the binaries carry the build-time path dependency rather than a relative or customer-appropriate configuration directory.

RemediationAI

Upgrade to vcpkg version 3.6.1#3 or later, which corrects the OpenSSL build configuration to avoid hardcoding build-machine paths into distributed binaries. After upgrading vcpkg, rebuild all OpenSSL-dependent libraries and applications to ensure new binaries contain the corrected configuration. The fix is implemented in commit 5111afdf55cc1429d9951e4c7b02010e659346a9 and merged via pull request #50518, both available in the GitHub repository (https://github.com/microsoft/vcpkg/pull/50518 and https://github.com/microsoft/vcpkg/commit/5111afdf55cc1429d9951e4c7b02010e659346a9). Organizations unable to immediately upgrade should implement compensating controls: restrict local user permissions to prevent directory creation at predictable build paths, monitor for suspicious filesystem activity at known vcpkg build path patterns, and apply principle of least privilege to limit impact of local account compromise. Review and rebuild any production applications using OpenSSL libraries originally compiled with vulnerable vcpkg versions, as the binary artifacts themselves carry the vulnerability regardless of current vcpkg installation status.