openssl_encrypt CVE-2026-81707

Exploitation requires that the target use openssl_encrypt's identity-import and fingerprint-verification workflow in a terminal that interprets ANSI/VT100 escape sequences (most standard terminal emulators). The attacker must get a crafted identity document to the victim through a supported channel - a keyserver response or the normal contact-exchange import flow. Limiting factors: the victim must actually import the malicious identity and visually rely on the displayed fingerprint line (user interaction), so purely automated or headless use, or verification via raw non-rendered fingerprint data, is not affected; terminals or viewers that neutralize control characters also blunt the attack. No authentication is required (CVSS PR:N).

The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H/VI:H/VA:H, score 9.3) rates this as critical with full CIA impact, but that rating is questionable: the described flaw is a display-spoofing/verification-bypass primitive whose direct impact is integrity (a forged fingerprint), not confidentiality or availability of the host, and it realistically requires the victim to import and visually inspect a crafted identity - i.e. user interaction the vector marks as UI:N. Confidentiality/integrity of subsequent communications can be compromised indirectly if the user is tricked into trusting an attacker-controlled key, so the high-severity intent is defensible even if VA:H is not. No EPSS score, KEV entry, or POC was provided, so there is no signal of active or imminent exploitation; the real-world risk is bounded by the product's very small deployment footprint and the need for a user to be walked through verification. This looks like a genuine security weakness that is high-severity in theory but low-urgency in practice given prevalence and lack of exploitation evidence.

An attacker crafts an identity bundle whose email field contains ANSI escape sequences and publishes it to a keyserver or hands it over during a normal contact exchange. When the victim imports it and runs the verification step, their terminal interprets the escapes and renders a fingerprint matching the attacker's substituted key; the victim confirms the 'match' and unknowingly trusts the wrong key. No public POC is identified at time of analysis, but the technique is low-complexity and requires no authentication.