CVE-2026-81686
Received Received - Intake

OpenSSL 1.4.x D-Bus Service Privilege Escalation and DoS

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: VulnCheck

Description
openssl_encrypt 1.4.x before 1.4.9 contains an optional D-Bus crypto service whose org.freedesktop.DBus.Properties.Set method performs neither a polkit authorization check nor value validation. Any local user on the system bus can call Set without authorization and set MaxConcurrentOperations (to 0/negative, causing the concurrency gate to refuse all subsequent operations, or to a huge value removing the limit) or the unbounded DefaultTimeout, resulting in a persistent denial of service of the root daemon. The D-Bus service exists only on the 1.4.x line and was removed in 1.5.x.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-08-27
AI Q&A
2026-08-27
EPSS Evaluated
N/A
NVD
CVE-2026-81686
EUVD
EUVD-2026-67042

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openssl openssl to 1.4.9 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the openssl_encrypt 1.4.x library before version 1.4.9. It involves an optional D-Bus crypto service that lacks proper authorization checks and input validation. A local user on the system bus can exploit this by calling the Set method to modify settings like MaxConcurrentOperations or DefaultTimeout, causing a persistent denial of service for the root daemon.

Impact Analysis

This vulnerability allows any local user to disrupt critical system operations by disabling the root daemon. This could lead to system instability, inability to perform cryptographic operations, and potential service outages affecting the entire system.

Mitigation Strategies

Upgrade OpenSSL to version 1.4.9 or later to remove the vulnerable D-Bus crypto service. If using the 1.5.x line, no action is needed as the service was removed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81686. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart