CVE-2026-81694: Improper Output Neutralization for Logs in jahlives openssl_encrypt

The openssl-encrypt package versions up to 1.4.8 fail to neutralize terminal control characters in filenames read from untrusted drives outside the AES-GCM authenticated manifest. These unsanitized filenames are printed in the output of the verify-usb command, enabling an attacker to craft filenames containing cursor-movement and erase-line control bytes. This can visually forge a PASSED verification result on screen, masking tampering detection. The vulnerability is addressed in version 1.4.9 by applying a sanitize_for_display() function to drive-derived names before output.

An attacker can exploit this vulnerability to manipulate the terminal output of the verify-usb command, causing it to display a false PASSED verdict even if tampering has occurred. This undermines the integrity of tamper detection by visually deceiving users or automated systems relying on the command output. There is no indication of privilege escalation or remote code execution, but the integrity and trustworthiness of verification results are critically impacted.

Upgrade to openssl-encrypt version 1.4.9 or later, where the vulnerability is fixed by sanitizing filenames before display. No other mitigation is required as the fix is official and addresses the root cause.