CVE-2026-81707

openssl_encrypt before 1.4.9 ANSI Escape Injection via Identity Email

No known exploitation. EPSS puts it in the 48th percentile. Fixed in 1.4.9.

CVSS 3.19.8Critical EPSS percentile48th0.6% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix1.4.9Upgrade to this build

Check it yourself

No ready-made check. Neither Nuclei nor OpenVAS has one for this CVE yet.

Request a scan

Published 2026-08-27Updated 2026-09-23Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Jahlives Openssl_encryptAffected: < 1.4.9Upgrade to: 1.4.9Stated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether your organization uses openssl_encrypt for importing or verifying contact identities/keys (versions before 1.4.9 are affected).
If you import identity bundles from keyservers or contacts, treat any fingerprint verification done before patching as unverified.
Upgrade openssl_encrypt to version 1.4.9 or later.
After upgrading, re-verify the fingerprints of any sensitive contacts imported before the update.
Ask your IT provider to confirm the update was applied to all systems that handle encrypted email.

Usually a quick update

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

openssl_encrypt before 1.4.9 fails to sanitize the email field of imported identity documents, allowing attackers to inject ANSI escape sequences that forge the fingerprint verification line displayed to users. Attackers can deliver a crafted identity bundle through normal contact-exchange flows or keyserver responses to manipulate terminal output and display a fraudulent fingerprint, bypassing the out-of-band verification mechanism that protects against key substitution attacks.

In plain language

Written by AI from the record

A tool used to verify encrypted email identities (openssl_encrypt) can be tricked into showing a fake 'verified' checkmark for someone's encryption key, which could let an attacker impersonate a trusted contact — update to the fixed version, but there's no sign anyone is exploiting this yet.

openssl_encrypt before 1.4.9 fails to sanitize the email field in imported identity documents, allowing ANSI escape injection that forges the fingerprint verification line and defeats out-of-band key verification, enabling key-substitution/impersonation attacks.

If you're affected

Impersonation of trusted contacts
Encrypted communications compromised
Man-in-the-middle key substitution
Loss of trust in verified identities

What is it

Think of this like a notary stamp that can be forged — when you verify someone's encryption key, the software shows a line confirming it's the real key. This flaw lets an attacker slip in a fake identity file that tricks the display into showing a 'verified' stamp for a key that isn't actually theirs. If you trust that fake stamp, you could end up encrypting sensitive messages to an impostor.

Who is affected

This matters to you if your organization uses openssl_encrypt to import, manage, or verify encryption identities for secure email or messaging. It's most relevant if you or your staff regularly import contact keys from keyservers or receive identity files from external parties, since that's how a malicious identity bundle would reach you.

How urgent is it

This flaw is rated critical and could let an attacker impersonate a trusted contact's encryption key, but there is no evidence of active exploitation and no public exploit code exists yet. Treat this as a priority to patch soon, not an emergency to drop everything for today.

What to do — in detail

Inventory systems and workflows that use openssl_encrypt, particularly any that import identity/key bundles from keyservers or external contact exchanges. 2. Confirm current version; any release before 1.4.9 is vulnerable. 3. Upgrade to 1.4.9 or later — check release notes for any changes to the identity-import or fingerprint-display workflow that could affect existing scripts or integrations. 4. If immediate upgrade isn't possible, avoid importing identity bundles from untrusted or unauthenticated sources (e.g., public keyservers) until patched, and manually verify fingerprints through a second independent channel rather than trusting the displayed line. 5. Not in CISA KEV and no exploit code is publicly known, so there is no mandated remediation deadline — but given the CVSS 9.8 severity, prioritize patching within your normal critical-vulnerability SLA. 6. Monitor vendor advisories and the EPSS score for any increase, which would indicate rising real-world interest.

Technical context

CVSS 3.1 score 9.8 (Critical), AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-exploitable, no privileges or user interaction beyond normal identity import, with full confidentiality, integrity, and availability impact rated due to downstream key-substitution potential. Weakness class is CWE-20 (Improper Input Validation), specifically failure to sanitize the email field, enabling ANSI escape sequence injection that manipulates terminal output to forge the fingerprint verification line. Not listed in CISA KEV; no public exploit code found. EPSS places predicted exploitation likelihood in the 46th percentile with a flat trend, indicating moderate but not elevated real-world exploitation interest. Exploit maturity is theoretical/PoC-absent at this time. Fixed in version 1.4.9.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS48th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.6% chance of exploitation activity in the next 30 days, which ranks it in the 48th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

6 events over 27 days, from the signal feeds we watch.

2026-09-23Record updated
2026-08-31Record updated
2026-08-27Publishedweakness classified, att&ck mapped, record updated

Affected products

jahlives
- openssl_encrypt

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable

Weaknesses

CWE-20No name in the record

ATT&CK techniques

Mapped from the weaknesses above (CWE to ATT&CK), not observed in attacks.

Initial AccessT1190Exploit Public-Facing Applicationlow confidence

Sources

References in the record

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Openssl_encrypt, not every advisory.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account