CVE-2026-81685

EUVD-2026-67041
openssl_encrypt versions before 1.4.9 fail to sanitize recovery-slot metadata in the desktop GUI, allowing attackers to inject control characters and line separators into the irreversible-removal confirmation dialog. Attackers can craft encrypted files with malicious slot identifiers containing bidi overrides or line-separator characters to forge warning text and deceive users during file removal operations.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
3.3 LOW
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 15.1%
Affected Products (NVD)
VendorProductVersion
jahlivesopenssl_encrypt
𝑥
< 1.4.9
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-49h2-qmcq-wvvc
https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-text-injection-via-recovery-slot-metadata