CVE-2026-81704: openssl_encrypt before 1.4.9 Weak Key Derivation via D-Bus
opensslencrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler that uses unstretched SHA-256 instead of Argon2id. Attackers can perform offline password guessing against encrypted files roughly six to seven orders of magnitude faster than documented protection by exploiting the missing key stretching and hash rounds.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openssl_encrypt (D-Bus CryptoService.EncryptFile handler)to a version that resolves this vulnerability.Fixed in 1.4.9
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using openssl_encrypt before 1.4.9 are exposed when encrypted files are produced through the D-Bus CryptoService.EncryptFile handler. The impact concerns the password-derived protection of those encrypted files.
What does an attacker need to exploit the weakness?
An attacker needs access to an encrypted file protected by the affected handler in order to conduct offline password guessing. No authentication or user interaction is required for the offline guessing attack.
Does exploitation require access to the running D-Bus service?
No. The described attack is offline password guessing against encrypted files, so the attacker can work from a copy of an affected encrypted file rather than interacting with the D-Bus service during guessing.
How can teams determine whether encrypted files may be affected?
Identify files encrypted by the CryptoService.EncryptFile handler in openssl_encrypt versions earlier than 1.4.9. Those files may have been protected using unstretched SHA-256 rather than Argon2id.