CVE-2026-81700
CriticalCVSS 9.8Summary
openssl_encrypt before 1.4.9 contains a signature verification vulnerability in gpg_runner.verify_detached that accepts revoked and expired keys by only checking VALIDSIG status without inspecting REVKEYSIG, EXPKEYSIG, or gpg exit codes. Attackers with compromised-then-revoked or expired keys can bypass signature verification to execute malicious plugins.
Risk Assessment
An attacker can run malicious plugins, leading to code execution in the host process and potential system compromise.
Recommendation
Update openssl_encrypt to version 1.4.9 or later, which includes the fix for signature verification considering revoked and expired keys.
Original NVD description (English source)
openssl_encrypt versions before 1.4.9 contain a signature verification vulnerability in gpg_runner.verify_detached that accepts revoked and expired keys by only checking VALIDSIG status without inspecting REVKEYSIG, EXPKEYSIG, or gpg exit codes. Attackers holding compromised-then-revoked signing keys or expired project keys can bypass signature verification to execute malicious plugins in the host process.