Skip to main content

openssl_encrypt CVE-2026-81685

| EUVDEUVD-2026-67041 CRITICAL
Improper Encoding or Escaping of Output (CWE-116)
2026-08-27 VulnCheck GHSA-qp5w-w4gh-6jc5
Code Injection Openssl Encrypt
9.3
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
9.3 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.1 HIGH

Requires the victim to open a crafted file and act on a spoofed dialog, so AV:L and UI:R; no confidentiality impact, but user-approved irreversible removal yields integrity and availability loss.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Aug 27, 2026 - 18:02 EUVD
Analysis Generated
Aug 27, 2026 - 17:43 vuln.today
CVE Published
Aug 27, 2026 - 14:50 cve.org
CRITICAL 9.3

DescriptionCVE.org

openssl_encrypt versions before 1.4.9 fail to sanitize recovery-slot metadata in the desktop GUI, allowing attackers to inject control characters and line separators into the irreversible-removal confirmation dialog. Attackers can craft encrypted files with malicious slot identifiers containing bidi overrides or line-separator characters to forge warning text and deceive users during file removal operations.

AnalysisAI

Output-encoding text injection in jahlives openssl_encrypt before 1.4.9 lets an attacker forge the desktop GUI's irreversible-removal confirmation dialog. By embedding bidirectional-override and line-separator control characters in the recovery-slot identifier of a crafted encrypted file, an attacker can rewrite the warning text a victim sees, tricking them into approving destructive file-removal operations. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Craft encrypted file with malicious slot identifier
Delivery
Deliver file to victim
Exploit
Victim opens file in GUI
Execution
Forged text renders in removal dialog
Persist
Victim approves irreversible removal
Impact
User data destroyed
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the victim to (1) run the affected desktop GUI of openssl_encrypt before 1.4.9, (2) open an attacker-crafted encrypted file containing malicious recovery-slot metadata, and (3) proceed into the irreversible-removal confirmation dialog and act on it. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, score 9.3) is internally inconsistent with the described mechanism and should be treated with caution. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker distributes a seemingly legitimate encrypted file whose recovery-slot identifier embeds a bidi override and line separators. The victim opens it in the openssl_encrypt desktop GUI and initiates removal; the forged confirmation dialog displays reassuring or misleading warning text, and the victim approves an irreversible removal they did not intend. …
Remediation Vendor-released patch: upgrade to openssl_encrypt 1.4.9 or later, which sanitizes recovery-slot metadata before display (see GHSA-49h2-qmcq-wvvc). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Audit all systems and applications to identify where jahlives openssl_encrypt is deployed and confirm current versions in use. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Openssl Encrypt

View all
CVE-2026-74872 CRITICAL
9.3 Aug 17

Arbitrary native code execution in the jahlives openssl_encrypt Python package (all versions before 1.4.0) arises from i
CVE-2026-74899 CRITICAL
9.3 Aug 17

Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 lets attacker-supplied plugin code break ou
CVE-2026-74887 CRITICAL
9.3 Aug 17

Insecure PRNG import in the jahlives openssl_encrypt Python package (all versions before 1.4.0) places Python's non-cryp
CVE-2026-81719 CRITICAL
9.3 Aug 27

Arbitrary code execution in openssl_encrypt (the jahlives Python encryption utility) before 1.4.9 allows an attacker-sup
CVE-2026-81717 CRITICAL
9.3 Aug 27

Cryptographic integrity bypass and weak key derivation in the openssl-encrypt Python package (jahlives) before 1.4.9 let
CVE-2026-81714 CRITICAL
9.3 Aug 27

Signature-trust bypass in the openssl_encrypt Python library (PyPI 'openssl-encrypt') versions 1.4.8 and earlier lets an
CVE-2026-81707 CRITICAL
9.3 Aug 27

Fingerprint-verification spoofing in jahlives openssl_encrypt before 1.4.9 lets attackers embed ANSI escape sequences in
CVE-2026-81706 CRITICAL
9.3 Aug 27

Silent cryptographic key substitution in jahlives openssl_encrypt before 1.4.9 lets attackers register 'shadow' contact

CVE-2026-81702 CRITICAL
9.3 Aug 27

Silent cryptographic key substitution affects openssl_encrypt (the jahlives Python encryption library) before 1.4.9, whi
CVE-2026-81701 CRITICAL
9.3 Aug 27

Arbitrary code execution in jahlives openssl_encrypt before 1.4.9 stems from a flawed plugin trust model that uses a den
CVE-2026-81700 CRITICAL
9.3 Aug 27

Signature verification bypass in openssl_encrypt (the jahlives Python encryption library) before version 1.4.9 lets atta
CVE-2026-81698 CRITICAL
9.3 Aug 27

Arbitrary command execution in jahlives' openssl_encrypt before 1.4.9 arises when the tool's 'info' command reconstructs

Same weakness CWE-116 – Improper Encoding or Escaping of Output

View all
CVE-2013-4547 HIGH POC
7.5
CVE-2026-20245 HIGH POC
7.8
CVE-2022-36446 CRITICAL POC
9.8
CVE-2017-8303 CRITICAL POC
9.8
CVE-2022-30781 HIGH POC
7.5
CVE-2023-46301 CRITICAL POC
9.8
CVE-2023-46300 CRITICAL POC
9.8
CVE-2022-41443 CRITICAL POC
9.8

Same technique Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2024-23692 CRITICAL POC
9.8
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8

Share

CVE-2026-81685 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy