CVE-2026-81707
openssl_encrypt before 1.4.9 ANSI Escape Injection via Identity Email
- State
- Published
- Severity
- 9.3 Critical
- Published
- Aug 27, 2026
- Updated
- Oct 1, 2026
- Reserved
- Aug 27, 2026
Description
openssl_encrypt before 1.4.9 fails to sanitize the email field of imported identity documents, allowing attackers to inject ANSI escape sequences that forge the fingerprint verification line displayed to users. Attackers can deliver a crafted identity bundle through normal contact-exchange flows or keyserver responses to manipulate terminal output and display a fraudulent fingerprint, bypassing the out-of-band verification mechanism that protects against key substitution attacks.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-20 Improper Input Validation
Affected Products
| Product | Versions |
|---|---|
openssl_encryptjahlives |
|
References
- GitHub Security Advisory (GHSA-qjr2-x6mr-8xgf)vendor-advisory
- VulnCheck Advisory: openssl_encrypt before 1.4.9 ANSI Escape Injection via Identity Emailthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.