CVE-2026-81685: Improper Encoding or Escaping of Output in jahlives openssl_encrypt
Description
openssl_encrypt versions before 1.4.9 fail to sanitize recovery-slot metadata in the desktop GUI, allowing attackers to inject control characters and line separators into the irreversible-removal confirmation dialog. Attackers can craft encrypted files with malicious slot identifiers containing bidi overrides or line-separator characters to forge warning text and deceive users during file removal operations.
CVSS v4.0
Score 9.3critical
Affected software
jahlives
openssl_encrypt
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in jahlives openssl_encrypt prior to version 1.4.9 arises from improper sanitization of recovery-slot metadata displayed in the desktop GUI. Attackers can craft encrypted files with malicious slot identifiers containing bidirectional (bidi) overrides or line-separator characters. When these files are processed, the confirmation dialog for irreversible file removal can be manipulated to display forged warning text, misleading users about the operation they are performing.
Potential Impact
An attacker can deceive users by injecting control characters and line separators into the file removal confirmation dialog, potentially causing users to unknowingly confirm irreversible removal of files. This manipulation undermines the integrity of the GUI warnings, increasing the risk of accidental data loss or unauthorized file deletion.
Mitigation Recommendations
A fix is available in jahlives openssl_encrypt version 1.4.9. Users should upgrade to version 1.4.9 or later to address this vulnerability. No additional mitigation steps are indicated beyond applying the official patch.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-27T11:11:30.934Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a906bb5acd9273b4983a1f6
Added to database: 08/27/2026, 16:54:13 UTC
Last enriched: 10/02/2026, 15:55:03 UTC
Last updated: 10/09/2026, 18:48:23 UTC
Views: 49
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.