CVE-2026-81700: Improper Verification of Cryptographic Signature in jahlives openssl_encrypt

The vulnerability in jahlives openssl_encrypt versions prior to 1.4.9 arises from the gpg_runner.verify_detached function accepting revoked and expired keys by only checking the VALIDSIG status. It neglects to inspect REVKEYSIG, EXPKEYSIG flags, or the exit codes from gpg, which are critical for proper signature validation. Consequently, attackers possessing signing keys that have been compromised and subsequently revoked, or keys that have expired, can bypass signature verification controls. This enables execution of malicious plugins in the context of the host process, posing a significant security risk.

Successful exploitation allows attackers to bypass cryptographic signature verification, enabling execution of malicious plugins within the host process. This compromises the integrity and trustworthiness of the software environment, potentially leading to unauthorized code execution without user interaction or privileges. The CVSS 4.0 score of 9.3 reflects the critical severity and the high impact on confidentiality, integrity, and availability.

A fix is available in jahlives openssl_encrypt version 1.4.9 and later. Users should upgrade to version 1.4.9 or newer to mitigate this vulnerability. No vendor advisory content was provided, so patch status is based on the affected version range indicating the fix. Until upgraded, users should consider restricting use of signing keys and verifying signatures with additional manual checks if possible.