openssl-encrypt CVE-2026-81717

Requires physical write access to an openssl-encrypt portable USB drive (the feature's own untrusted-drive threat model). Integrity-bypass/autorun path: the attacker adds files not present in the drive manifest - including a root-level autorun payload - and the victim must subsequently mount and use the drive for the payload to execute, so victim interaction limits this path. Key-recovery path: the target drive must lack a per-drive salt file, causing the constant _LEGACY_FIXED_SALT to be used, which enables offline rainbow-table precomputation without any victim interaction. Affected only in openssl-encrypt before 1.4.9 and only for drives handled by the portable USB drive feature; drives already carrying a unique per-drive salt are not exposed to the salt weakness. Note the published CVSS AV:N does not match these physical/local prerequisites.

The published CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, VC:H/VI:H/VA:H, base 9.3 Critical) conflicts sharply with the stated threat model: the description explicitly requires an attacker with PHYSICAL write access to a removable drive, which is AV:P - not the network vector (AV:N) the score claims. This discrepancy should be verified with the vendor, and the raw 9.3 almost certainly overstates real-world risk. Adjusting for the physical prerequisite and, for the code-execution path, the need for a victim to mount and run the drive, practical severity is more moderate. No EPSS score, KEV listing, or POC was provided; there is no public exploit identified at time of analysis and no evidence of active exploitation. Net assessment: a legitimate cryptographic weakness worth patching, but gated behind physical access to a niche tool's USB drives, making it a low-urgency, targeted-scenario issue rather than a broadly wormable network threat.

An attacker who gains temporary physical access to a target's openssl-encrypt portable USB drive writes a malicious root-level autorun payload plus files not listed in the drive manifest; integrity verification passes because it only checks manifest entries, and when the victim later plugs in and uses the drive the payload runs. In parallel, because a drive without a per-drive salt uses the constant _LEGACY_FIXED_SALT, the attacker can precompute a rainbow table offline to recover the drive key and decrypt its contents. No public POC was provided, so exploitation requires the attacker to develop the technique.