openssl_encrypt CVE-2026-81682

Exploitation requires the attacker to hold a local unprivileged account on the same multi-user host as the victim. A legitimate user must have run the openssl_encrypt desktop GUI to decrypt a file, creating the world-readable output on disk. The attacker must know or discover the path to the decrypted output file. Limiting factors: no network attack path exists (AV:L); a victim must actively use the GUI on a shared system; single-user workstations are not meaningfully exposed. No special configuration enables the flaw - the insecure permissions are the default behavior of the affected GUI versions. There is no requirement for a non-default configuration; the flaw is present in standard installations before 1.4.9.

The provided CVSS 4.0 score of 8.6 with VC:H/VI:H/VA:H materially overstates the impact: the description supports only unauthorized read access to decrypted files (confidentiality breach), not integrity or availability compromise; VI:H and VA:H are not corroborated by the vulnerability description and should be treated as suspect. The attack is strictly local (AV:L), requires co-residency on a shared multi-user system, and depends on a legitimate user having run the GUI to produce decrypted output, significantly narrowing the realistic threat population. No EPSS score is available in the provided intelligence, and absence from CISA KEV combined with no identified public exploit code suggests low active-exploitation probability. Real-world risk is meaningful only for shared multi-user environments where sensitive files are decrypted using this GUI, not for single-user workstations. The conflicting CVSS integrity and availability signals versus the description-supported impact class should be verified against the vendor advisory before driving remediation prioritization.

An attacker with a local unprivileged account on a shared Linux or macOS workstation identifies the output directory used by the openssl_encrypt GUI. After a legitimate user decrypts a sensitive file using the GUI, the attacker reads the world-readable plaintext output file directly using standard file-read commands without any privilege escalation. No public exploit code is identified; the technique requires only knowledge of the output file path and a local account on the same system.