openssl_encrypt CVE-2026-81688

The attacker must obtain a physical or logical copy of at least one encrypted file produced by openssl_encrypt prior to version 1.4.9 - this is the sole prerequisite for extracting the cleartext header hash. No authentication, network-level access to a running service, or special privilege is required beyond file possession. The oracle is most effective against low-entropy or predictable plaintexts; high-entropy random content substantially increases offline brute-force cost. Exploitation is strictly passive information disclosure: the attacker cannot decrypt file contents, modify ciphertext undetected, or execute code. Files never exposed to unauthorized parties are not exploitable, as the flaw is a property of the file format rather than a remotely accessible service endpoint.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) reflects high confidentiality impact once an attacker has obtained an encrypted file, and is consistent with the passive, zero-prerequisite nature of hash extraction from the file header. The absence of EPSS data and a CISA KEV listing means exploitation frequency cannot be quantified from available signals; no public exploit code has been reported. Real-world risk is highest in deployment patterns where openssl_encrypt-protected files transit potentially hostile networks or are stored on shared infrastructure - scenarios where an adversary can passively collect encrypted files without breaking the underlying cipher. The oracle is most effective against low-entropy plaintexts (short messages, templated documents, known file formats), substantially reducing the brute-force search space for offline confirmation. The vulnerability does not enable decryption, code execution, or integrity compromise, which tempers the urgency compared to a full compromise vector, but the confidentiality impact is genuine and unmitigated by password strength alone.

An attacker who intercepts an encrypted file in transit - or retrieves one from a misconfigured storage location - opens the file header and reads the embedded SHA-256 hash without needing the encryption password. The attacker then hashes candidate plaintexts (e.g., known document templates, short messages, or dictionary words) and compares each digest against the extracted header value, confirming the original content when a match is found. Across a corpus of collected files, matching header hashes also reveal which documents are identical, enabling content-based correlation even across separate encryption sessions.