CVE-2026-81718: Inadequate Encryption Strength in jahlives openssl_encrypt

The vulnerability CVE-2026-81718 affects jahlives openssl_encrypt versions prior to 1.4.9. The issue is that the PBKDF2-HMAC-SHA256 key derivation function is configured with insufficient iteration counts (100,000 for PQC keyfile private keys and 10,000 for dual-encryption password verification). This weak parameterization reduces the computational cost for attackers to brute-force wrapping passwords offline, especially when leveraging hardware acceleration such as GPUs or ASICs. The vulnerability does not require user interaction or privileges and can be exploited remotely if attackers obtain the encrypted keyfiles or files.

Attackers who obtain encrypted keyfiles or files protected by the affected versions can attempt offline brute-force attacks against the wrapping passwords. The low iteration counts in PBKDF2 reduce the time and resources needed for such attacks, increasing the risk of password recovery and subsequent unauthorized decryption of sensitive data. The CVSS 4.0 base score of 8.7 reflects a high impact due to the ease of attack and the confidentiality compromise potential.

A fix is available in jahlives openssl_encrypt version 1.4.9 or later. Users should upgrade to version 1.4.9 or newer to benefit from increased PBKDF2 iteration counts and improved encryption strength. Until upgrading, users should consider protecting keyfiles and encrypted files with stronger passwords and limit access to these files to trusted parties only. Patch status is confirmed by the affectedVersions field indicating versions <1.4.9 are vulnerable and fixed in 1.4.9.