CVSS 4.0
9.3 criticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NCVE-2026-81695
Critical (9.3) in jahlives openssl encrypt. EPSS 0.2% chance of exploitation in the next 30 days. Fixed in openssl-encrypt 1.4.9.
openssl_encrypt versions before 1.4.9 fail to escape attacker-controlled key_id values printed to stderr during decrypt auto-detection. Attackers can craft encrypted files with malicious key_id containing escape sequences to repaint terminal output and forge authenticity verification blocks.
Severity
CVSS 3.1
3.3 lowCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 16% of CVEs (scores of 2026-10-31)
- CWE
- CWE-117
- Published
- Modified
- Record from
- the NVD, synced
Affected
- jahlives:openssl_encrypt
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| PYSEC-2026-3774 | PyPI | openssl-encrypt | <1.4.9 | 1.4.9 |