CVE-2026-81707: openssl_encrypt before 1.4.9 ANSI Escape Injection via Identity Email
opensslencrypt before 1.4.9 fails to sanitize the email field of imported identity documents, allowing attackers to inject ANSI escape sequences that forge the fingerprint verification line displayed to users. Attackers can deliver a crafted identity bundle through normal contact-exchange flows or keyserver responses to manipulate terminal output and display a fraudulent fingerprint, bypassing the out-of-band verification mechanism that protects against key substitution attacks.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of affected openssl_encrypt versions who import identity documents through contact-exchange flows or receive them from keyserver responses are exposed, particularly when they verify fingerprints in a terminal.
What does an attacker need to exploit it?
An attacker needs to supply a crafted identity bundle containing ANSI escape sequences in the identity email field. No authentication or user interaction is required according to the supplied severity vector.
Is the default verification output trustworthy on affected versions?
No. A crafted identity can manipulate terminal output to display a fraudulent fingerprint verification line, undermining the out-of-band verification process intended to detect key substitution.
How can I tell whether I may be affected?
Check whether your openssl_encrypt version is earlier than 1.4.9 and whether it processes imported identity documents from contact exchanges or keyserver responses.