CVE-2026-81694

Analyzed Analyzed - Analysis Complete

openssl-encrypt USB Drive Filename Terminal Control Escape

Publication date: 2026-08-27

Last updated on: 2026-09-03

Assigner: VulnCheck

Description

openssl-encrypt (pip package, versions <= 1.4.8) fails to sanitize filenames read from untrusted drive data (outside the AES-GCM authenticated manifest) before printing them in the verify-usb command's output. An attacker can plant filenames containing terminal cursor-movement and erase-line control bytes that repaint a forged PASSED verdict on screen, masking actual tamper detection. Fixed in 1.4.9 by routing drive-derived names through sanitize_for_display().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-03

Generated

2026-09-17

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2026-81694

EUVD

EUVD-2026-67050

Affected Vendors & Products

Vendor	Product	Version / Range
jahlives	openssl_encrypt	to 1.4.9 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-117	The product constructs a log message from external input, but it does not neutralize or incorrectly neutralizes special elements when the message is written to a log file.

Attack-Flow Graph

Executive Summary

This vulnerability affects the openssl-encrypt package (versions <= 1.4.8). The verify-usb command scans untrusted drive data but fails to sanitize filenames before displaying them. Attackers can craft filenames with terminal control characters to overwrite output and forge a PASSED verdict, hiding actual tamper detection. The issue was fixed in version 1.4.9 by sanitizing filenames before display.

Detection Guidance

Check the installed version of the openssl-encrypt package. If it is version 1.4.8 or lower, the system is vulnerable. Run: pip show openssl-encrypt or pip list | grep openssl-encrypt to verify the version.

Impact Analysis

An attacker could trick you into believing a compromised drive is safe by manipulating the verify-usb output to show PASSED even if tampering occurred. This could lead to unknowingly using malicious or altered files, potentially causing data breaches or further system compromise. The forged output masks security checks, undermining trust in the verification process.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it involves output manipulation in a specific tool rather than data exposure or unauthorized access. However, if the tool is used in systems handling sensitive data, forged verification results could lead to undetected tampering, potentially violating integrity requirements under these regulations.

Mitigation Strategies

Upgrade the openssl-encrypt package to version 1.4.9 or later. Use: pip install --upgrade openssl-encrypt. Avoid using the verify-usb command on untrusted drives until the update is applied.

Hi! I’m here to help you understand CVE-2026-81694. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70