openssl-encrypt CVE-2026-81684

Exploitation requires an existing local user account on the Linux host where openssl-encrypt is installed. The vulnerable condition is triggered exclusively when a user operates the openssl-encrypt desktop GUI and initiates an encrypt or decrypt operation that involves the steganography feature - the --stego-password argument is only passed when this feature is actively used. The exploit window is limited to the subprocess lifetime of that operation, typically seconds, requiring the attacker to monitor /proc continuously. The main encryption password is passed via environment variable and is not exposed. The vulnerability does not apply to CLI-only usage that bypasses the GUI, to Windows deployments where /proc is unavailable, or to any operation that does not invoke the steganography password feature. Exploitation is bounded to shared-access Linux hosts where at least one other local account exists alongside the victim.

The CVSS 4.0 score of 6.9 with vector AV:L/AC:L/AT:N/PR:N/UI:N reflects a locally exploitable confidentiality-only vulnerability. The local attack vector (AV:L) is the primary risk constraint: an attacker must already possess an active session on the affected host. Once local access exists, no special privileges, configurations, or victim interaction are required to read /proc entries - AC:L and PR:N are accurate. The practical difficulty is the narrow exploit window: the steganography password is only exposed for the duration of the child subprocess (typically seconds), requiring the attacker to poll /proc continuously or use filesystem event monitoring (e.g., inotifywait) to catch the entry before it disappears. This timing dependency makes opportunistic exploitation harder than raw CVSS metrics suggest, though a determined local attacker with a persistent script would find this reliably exploitable. The vulnerability is not in CISA KEV and no public proof-of-concept has been identified, consistent with its local-only, narrow-window character. The impact is the full disclosure of the steganography password, which may completely undermine the confidentiality model of the steganographic operation - the purpose of steganography is concealment, so password disclosure defeats that purpose entirely regardless of CVSS score. Multi-user systems where openssl-encrypt is deployed are the realistic risk scenario.

A local attacker with a shell session on a multi-user Linux host runs a polling loop against /proc watching for an openssl-encrypt child process, then reads /proc/<pid>/cmdline during that subprocess's lifetime to extract the --stego-password value in plaintext. The entire attack is achievable with standard Linux utilities (e.g., grep -r stego-password /proc/*/cmdline on a polling loop) and requires no elevated privileges. No public proof-of-concept code has been identified, but the technique requires no specialized knowledge.