CVE-2026-81696 CRITICAL

CVE-2026-81696: openssl_encrypt before 1.4.9 Terminal Injection via info Command

Vendor Jahlives
Product openssl_encrypt
Weakness CWE-117
Published August 27, 2026
Last update August 27, 2026
View on NVD All CVEs

CVSS base score

9.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

openssl_encrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious files containing escape sequences to repaint terminal output and forge verification information displayed to users.

Key dates

02Disclosure timeline

August 27, 2026 CVE published
August 27, 2026 Record updated