CVE-2026-81685
LowCVSS 3.3Summary
openssl_encrypt versions before 1.4.9 fail to sanitize recovery-slot metadata in the desktop GUI, allowing attackers to inject control characters and line separators into the irreversible-removal confirmation dialog. Attackers can craft encrypted files with malicious slot identifiers containing bidi overrides or line-separator characters to forge warning text and deceive users during file removal operations.
Risk Assessment
Forged warning texts could trick users into approving irreversible deletion of important files, potentially leading to data loss or integrity compromise.
Recommendation
Update openssl_encrypt to version 1.4.9 or later, which includes the fix for sanitizing slot metadata.
Original NVD description (English source)
openssl_encrypt versions before 1.4.9 fail to sanitize recovery-slot metadata in the desktop GUI, allowing attackers to inject control characters and line separators into the irreversible-removal confirmation dialog. Attackers can craft encrypted files with malicious slot identifiers containing bidi overrides or line-separator characters to forge warning text and deceive users during file removal operations.