openssl_encrypt CVE-2026-81696

Requires the victim to run the 'info' command of openssl_encrypt (versions before 1.4.9) against an attacker-crafted file whose metadata contains terminal control/escape sequences, and requires a terminal emulator that interprets those sequences. Exploitation is limited by that necessary user interaction (the operator must choose to inspect the malicious file) and by terminal behavior - emulators that do not honor certain escape codes reduce impact. There is no privilege requirement and no authentication, but success depends on social engineering to get the victim to view the file.

The published CVSS 4.0 score of 9.3 (VC:H/VI:H/VA:H, PR:N, UI:N) substantially overstates real-world risk for this bug class. Terminal-injection/log-injection (CWE-117) is fundamentally an integrity/spoofing issue, not full compromise of confidentiality and availability, and exploitation realistically requires the victim to run the 'info' command against an attacker-supplied file - i.e., user interaction that the scored vector omits (UI:N). There is no KEV listing and no public exploit identified, so this is not an urgent mass-exploitation event; the credible threat is targeted social-engineering where a forged 'verified' banner tricks an operator into trusting a malicious file. The honest read is a genuine but moderate-severity spoofing flaw whose scored 9.3 conflicts with the CWE and the interaction requirement - verify the vendor scoring rather than treating it as a critical RCE-equivalent.

An attacker crafts a file whose metadata field contains ANSI escape sequences and delivers it to a victim (e.g., as a supposedly encrypted deliverable). When the victim inspects it with 'openssl_encrypt info malicious.file', the escape sequences reposition the cursor and overwrite the output to display a forged 'signature valid / integrity verified' message, causing the victim to trust a tampered file. No public exploit code is identified at time of analysis.