openssl-encrypt CVE-2026-81681

Exploitation requires physical possession of or access to the removable/USB media on which the victim created an openssl_encrypt 'Encrypted USB Workspace' using a vulnerable version (<= 1.4.8), and the victim must have actually used that workspace feature to store files. The limiting factors are significant: the attacker needs the physical device (no remote/network path despite the input's AV:N rating), the victim must have opted into the specific 'Encrypted USB Workspace' feature rather than another encryption mode, and only data placed in that workspace is exposed. There is no user interaction or authentication barrier for the attacker once the media is in hand, and the impact is confidentiality only - the false 'encrypted' marker does not protect the plaintext beneath it.

The signals conflict and must be reconciled. The supplied CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N/VC:H/VI:H/VA:H, score 9.3) models a remote, unauthenticated, full-CIA-impact flaw, but the description clearly requires an attacker with PHYSICAL access to the removable media and yields only confidentiality loss (reading cleartext files). The AV:N and VI:H/VA:H ratings are not supported by the description - verify with the vendor; a physical-access, confidentiality-only assessment is far more defensible (see assessed vectors below). There is no EPSS score, no KEV listing, and no POC provided, so this is not evidence of widespread active exploitation. Real-world risk is a targeted, opportunistic threat: someone who steals, finds, or borrows the USB device gets plaintext, and the danger is amplified because victims believe the data is encrypted and may therefore be less careful with the media. Absolute risk is bounded by the product's niche footprint and the physical-access requirement, not the inflated 9.3.

A user encrypts sensitive documents into what openssl_encrypt labels an 'Encrypted USB Workspace,' sees the marker confirming AES-256-GCM protection, and carries the USB drive with them. The drive is lost or stolen, or briefly left unattended; the attacker plugs it into any machine and reads the files directly because they were never encrypted. No POC is needed and no cryptographic attack is required - the data is simply cleartext.