CVE-2026-81680
MediumCVSS 4.0Summary
openssl_encrypt versions before 1.4.9 fail to authenticate recovery-slot presence in envelope-format encrypted files, allowing attackers to remove recovery slots without re-encrypting the payload. Attackers can modify the file header to delete recovery-slot fields and bypass authentication, silently removing recovery paths the owner deliberately added.
Risk Assessment
The risk is that an attacker can prevent the owner from recovering data in case of password loss, potentially leading to permanent loss of access to encrypted information.
Recommendation
Upgrade to version 1.4.9, which authenticates recovery-slot presence, and verify the integrity of encrypted files.
Original NVD description (English source)
openssl_encrypt versions before 1.4.9 fail to authenticate recovery-slot presence in envelope-format encrypted files, allowing attackers to remove recovery slots without re-encrypting the payload. Attackers can modify the file header to delete recovery-slot fields and bypass authentication, silently removing recovery paths the owner deliberately added.