CVE-2026-81696

Analyzed Analyzed - Analysis Complete

OpenSSL Encrypt Terminal Control Character Injection

Publication date: 2026-08-27

Last updated on: 2026-09-01

Assigner: VulnCheck

Description

openssl_encrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious files containing escape sequences to repaint terminal output and forge verification information displayed to users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-01

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-81696

EUVD

EUVD-2026-67052

Affected Vendors & Products

Vendor	Product	Version / Range
jahlives	openssl_encrypt	to 1.4.9 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-117	The product constructs a log message from external input, but it does not neutralize or incorrectly neutralizes special elements when the message is written to a log file.

Attack-Flow Graph

Executive Summary

This vulnerability affects openssl_encrypt versions before 1.4.9. It involves improper handling of terminal control characters in file metadata displayed by the info command. Attackers can create malicious files with escape sequences that manipulate terminal output, forging verification information shown to users.

Detection Guidance

To detect this vulnerability, check the version of openssl_encrypt installed on your system. Run: pip show openssl_encrypt. If the version is less than 1.4.9, the system is vulnerable. Additionally, inspect files processed by the info command for terminal control characters or unusual metadata.

Impact Analysis

An attacker could trick you into viewing a malicious file, causing your terminal to display false verification details like fake fingerprints. This could lead to accepting tampered files unknowingly, potentially compromising system integrity or security checks.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it involves terminal output manipulation rather than data exposure or unauthorized access. However, if forged verification information leads to incorrect data handling or processing decisions, it could indirectly impact compliance by causing errors in audit trails or verification processes.

Mitigation Strategies

Upgrade openssl_encrypt to version 1.4.9 or later immediately using: pip install --upgrade openssl_encrypt. Avoid using the info command on untrusted files until patched. Monitor for suspicious terminal output manipulation.

Hi! I’m here to help you understand CVE-2026-81696. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70