CVE-2026-81695: openssl_encrypt before 1.4.9 Terminal Injection via key_id
opensslencrypt versions before 1.4.9 fail to escape attacker-controlled keyid values printed to stderr during decrypt auto-detection. Attackers can craft encrypted files with malicious keyid containing escape sequences to repaint terminal output and forge authenticity verification blocks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openssl_encryptto a version that resolves this vulnerability.Fixed in 1.4.9 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch Terminal Injection via key_id
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Users of affected openssl_encrypt versions who decrypt encrypted files from untrusted sources and view stderr in a terminal are exposed. The issue occurs during decrypt auto-detection when the file contains an attacker-controlled key_id.
What does an attacker need to exploit this vulnerability?
An attacker needs to provide a crafted encrypted file whose key_id includes terminal escape sequences. Exploitation also requires a user to decrypt that file, making this a user-interaction-dependent issue.
What is the security impact?
The crafted output can repaint terminal content and forge authenticity-verification blocks. The supplied severity data rates the impact as low, with low integrity impact and no confidentiality or availability impact.
Which versions should be updated?
openssl_encrypt versions before 1.4.9 are affected. Updating to version 1.4.9 or later addresses the stated vulnerable version range.