CVE-2026-81720

Analyzed Analyzed - Analysis Complete

OpenSSL Memory Exhaustion in Identity File Protection

Publication date: 2026-08-27

Last updated on: 2026-09-03

Assigner: VulnCheck

Description

openssl_encrypt before 1.4.9 fails to validate the memory_cost parameter from identity file protection blocks, allowing attackers to trigger out-of-memory conditions during key derivation. Attackers with write access to local identity stores can craft malicious identity files with excessive memory_cost values that cause the host to crash when unlocking identities before authentication.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-03

Generated

2026-09-17

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2026-81720

EUVD

EUVD-2026-67070

Affected Vendors & Products

Vendor	Product	Version / Range
jahlives	openssl_encrypt	to 1.4.9 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability affects openssl_encrypt versions before 1.4.9. It allows attackers with local write access to craft malicious identity files with excessive memory_cost values in identity file protection blocks. When these files are used to unlock identities before authentication, they trigger out-of-memory conditions causing the host system to crash.

Detection Guidance

Detecting this vulnerability requires checking the version of openssl_encrypt installed on your system. Use the command 'openssl_encrypt --version' or check package managers like 'apt list --installed | grep openssl_encrypt' or 'yum list installed openssl_encrypt'. If the version is before 1.4.9, the system is vulnerable.

Impact Analysis

The impact includes system crashes due to out-of-memory conditions triggered by crafted identity files. Attackers can disrupt services before authentication, potentially causing denial-of-service conditions on affected systems using vulnerable openssl_encrypt versions.

Compliance Impact

This vulnerability causes out-of-memory crashes during key derivation, leading to system instability or denial of service. Such disruptions could violate availability requirements in GDPR (Article 32) and HIPAA (Security Rule §164.308(a)(7)), which mandate safeguards against service interruptions affecting data access or integrity.

Mitigation Strategies

Immediately update openssl_encrypt to version 1.4.9 or later. If updating is not possible, restrict write access to local identity stores to prevent attackers from crafting malicious identity files. Monitor system memory usage for unusual spikes during identity unlocking processes.

Hi! I’m here to help you understand CVE-2026-81720. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70