CVE-2026-81703
MediumCVSS 5.5Summary
openssl_encrypt versions before 1.4.9 fail to validate encryption status of embedded post-quantum private keys in file metadata. Attackers can craft files with unencrypted embedded PQC keys that decrypt under any password, bypassing authentication and producing attacker-chosen plaintext with false integrity verification.
Risk Assessment
The risk includes the possibility of bypassing authentication and falsifying data integrity, which could allow an attacker to deliver malicious files that are accepted as authentic. This could lead to data security breaches.
Recommendation
It is recommended to update openssl_encrypt to version 1.4.9 or later, which includes the fix. Also avoid opening files from untrusted sources.
Original NVD description (English source)
openssl_encrypt versions before 1.4.9 fail to validate encryption status of embedded post-quantum private keys in file metadata. Attackers can craft files with unencrypted embedded PQC keys that decrypt under any password, bypassing authentication and producing attacker-chosen plaintext with false integrity verification.