CVE-2026-81720: Uncontrolled Resource Consumption in jahlives openssl_encrypt

The vulnerability occurs because openssl_encrypt versions prior to 1.4.9 do not validate the memory_cost parameter used in identity file protection blocks. An attacker who can write to local identity stores can craft malicious identity files with excessively large memory_cost values. When the system attempts to unlock these identities, the excessive memory allocation triggers out-of-memory conditions, leading to a denial of service by crashing the host before authentication completes.

Exploitation of this vulnerability can cause denial of service by crashing the host system during the key derivation process when unlocking identities. This requires the attacker to have write access to local identity stores. There is no indication of privilege escalation or data disclosure from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict write access to local identity stores to trusted users only to prevent crafting of malicious identity files with excessive memory_cost values.