CVE-2026-81720
MediumCVSS 6.2Summary
openssl_encrypt before 1.4.9 fails to validate the memory_cost parameter from identity file protection blocks, allowing attackers to trigger out-of-memory conditions during key derivation. Attackers with write access to local identity stores can craft malicious identity files with excessive memory_cost values that cause the host to crash when unlocking identities before authentication.
Risk Assessment
The risk includes the possibility of crashing the system by an attacker with local access to identity stores, leading to service unavailability. This could be exploited for DoS attacks.
Recommendation
It is recommended to update openssl_encrypt to version 1.4.9 or later, which includes the fix. Also restrict access to identity stores.
Original NVD description (English source)
openssl_encrypt before 1.4.9 fails to validate the memory_cost parameter from identity file protection blocks, allowing attackers to trigger out-of-memory conditions during key derivation. Attackers with write access to local identity stores can craft malicious identity files with excessive memory_cost values that cause the host to crash when unlocking identities before authentication.