Microsoft vcpkg versions before 3.6.1#3 contain an uncontrolled search path element vulnerability (CWE-427) in the Windows builds of OpenSSL. Specifically, the openssldir was set to a directory path from the build machine, which could be leveraged by attackers on customer machines to influence the loading of libraries or binaries. This vulnerability has a CVSS 3.1 base score of 7.8, indicating high severity, with attack vector local, low attack complexity, requiring low privileges and no user interaction, and impacts confidentiality, integrity, and availability. The vulnerability was patched in version 3.6.1#3 of vcpkg.

The vulnerability allows an attacker with local access and low privileges to exploit the improperly set openssldir path, potentially leading to compromise of confidentiality, integrity, and availability of the affected system. This could result in execution of malicious code or unauthorized access due to the uncontrolled search path element. No known exploits in the wild have been reported.

Upgrade vcpkg to version 3.6.1#3 or later, where the vulnerability has been patched. No other mitigation is required as the issue is resolved in this official fix.