The vulnerability CVE-2026-34054 affects Microsoft vcpkg versions earlier than 3.6.1#3. It involves an uncontrolled search path element in the Windows builds of OpenSSL bundled with vcpkg, where the openssldir was set to a build machine path. This misconfiguration allows an attacker with local privileges to potentially influence the loading of libraries or configuration files, leading to confidentiality, integrity, and availability impacts. The vulnerability is classified under CWE-427 and has a CVSS v3.1 score of 7.8, indicating high severity. The issue has been fixed in vcpkg version 3.6.1#3.

Exploitation of this vulnerability could allow an attacker with local access to manipulate the search path used by OpenSSL, potentially leading to execution of malicious code or unauthorized access to sensitive information. The CVSS score reflects high impact on confidentiality, integrity, and availability. There are no known exploits in the wild at the time of publication.

This vulnerability has been patched in Microsoft vcpkg version 3.6.1#3. Users should upgrade to this version or later to remediate the issue. Since this is not a cloud service, remediation depends on applying the official fix by updating the software. Patch status is confirmed by the vendor advisory indicating the fix is included in version 3.6.1#3.