CVE-2026-81695
Received Received - Intake

OpenSSL Encrypt Key ID Escape in stderr Output

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: VulnCheck

Description
openssl_encrypt versions before 1.4.9 fail to escape attacker-controlled key_id values printed to stderr during decrypt auto-detection. Attackers can craft encrypted files with malicious key_id containing escape sequences to repaint terminal output and forge authenticity verification blocks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-08-27
AI Q&A
2026-08-27
EPSS Evaluated
N/A
NVD
CVE-2026-81695
EUVD
EUVD-2026-67051

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openssl openssl_encrypt to 1.4.9 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-117 The product constructs a log message from external input, but it does not neutralize or incorrectly neutralizes special elements when the message is written to a log file.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects openssl_encrypt versions before 1.4.9. It allows attackers to inject malicious escape sequences into terminal output by crafting encrypted files with specially designed key_id values. These sequences can repaint terminal text and forge authenticity verification blocks during decryption auto-detection.

Detection Guidance

Check if your system uses openssl_encrypt versions before 1.4.9 by running: openssl_encrypt --version. If the version is below 1.4.9, the system is vulnerable. Monitor stderr output during decryption operations for unexpected terminal behavior or forged authenticity blocks.

Impact Analysis

Attackers could manipulate terminal output to display false information, potentially tricking users into believing forged authenticity verification blocks. This could lead to misplaced trust in encrypted files or data integrity deception.

Mitigation Strategies

Upgrade openssl_encrypt to version 1.4.9 or later immediately. Avoid processing untrusted encrypted files until patched. Implement input validation for key_id values if custom decryption workflows exist.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81695. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart