openssl_encrypt CVE-2026-81703

Exploitation requires that the target system runs openssl_encrypt in a version prior to 1.4.9 and that the attacker can deliver a crafted encrypted file to a code path that invokes the library's decryption logic. No authentication, elevated privileges, or special configuration is required on the attacker's side - the CVSS 4.0 vector (PR:N/UI:N/AC:L) confirms unauthenticated, zero-interaction exploitation. The limiting factor is delivery: the attacker must be able to supply a malicious file to the application - for example through a file-upload endpoint, shared network storage, or any interface that passes file data to the vulnerable decrypt path. Deployments that only decrypt internally-generated files and never accept externally-supplied encrypted content face significantly reduced risk, but this is a deployment characteristic, not a product-level protection.

The CVSS 4.0 base score of 8.7 is assigned with AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N, indicating a network-accessible, unauthenticated, low-complexity attack requiring no user interaction and yielding high confidentiality impact on the vulnerable system. This vector is internally consistent with the description: an attacker crafts a file and delivers it to any endpoint running a vulnerable version of the library; no account or special configuration is prerequisite. No EPSS score was included in the source intelligence, so exploitation probability cannot be quantified probabilistically. The vulnerability is absent from the CISA KEV catalog and no POC has been reported, suggesting it has not been operationalized in the wild as of this analysis. Despite the high CVSS score, the realistic blast radius is bounded by the niche deployment footprint of this library - organizations not using openssl_encrypt for PQC-enabled file encryption are not affected. For those who do use it, the risk is material: an attacker who can deliver a crafted file (e.g., via upload endpoint, email attachment, or shared storage) can completely subvert the encryption and authentication guarantees that the library is supposed to provide.

An attacker targeting a web application or automated pipeline that accepts encrypted file uploads constructs a file with an unencrypted PQC private key planted in the file's metadata section. When the vulnerable openssl_encrypt library processes this file, it accepts any password the application supplies, outputs attacker-chosen plaintext, and returns a passing integrity verification status - causing the application to trust and act on fabricated decrypted content. No public exploit code has been identified at time of analysis, but the zero-complexity, unauthenticated network attack surface means exploitation requires only knowledge of the file format, not special tooling.