CVE-2026-81705: Insertion of Sensitive Information into Log File

openssl-encrypt before 1.4.9 fails to redact the file password in its --debug argv dump when the password is supplied via bundled short-option spellings e.g. -apHunter2 or abbreviated long-option spellings e.g. --passw. The sanitizer only recognized exact option names, --option=value forms, and...

PT-2026-85193

openssl encrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger unbounded memory allocation and cause denial of service through out-of-memory conditions...

PT-2026-82598

Name of the Vulnerable Software and Affected Versions openssl-encrypt versions prior to 1.4.9 Description A configuration file resolution flaw exists in crypt settings.py where the CONFIG FILE variable is reassigned to a relative path. This causes the legacy Tk GUI's SettingsTab to read and write...

PT-2026-85198

openssl encrypt before 1.4.9 fails to validate KDF cost parameters in encrypted file metadata and keystore headers, allowing attackers to trigger unbounded memory allocation. Attackers can craft malicious encrypted files declaring arbitrarily large Argon2, scrypt, or balloon KDF parameters to...

PT-2026-82593

Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.9 Description The software fails to validate the 36-bit STREAMINFO total samples field of FLAC files before using it to size a memory allocation within the np.random.randintsize=total samples, channels...

PT-2026-85197

openssl encrypt before 1.4.9 executes untrusted third-party plugins with insufficient controls: the plugin signature policy defaulted to WARN, so an unsigned/unverifiable non-built-in plugin was compiled and executed in the host process at import time, before the runtime sandbox is installed. The...

CVE-2026-81715: Insertion of Sensitive Information into Log File

opensslencrypt pip package openssl-encrypt versions = 1.4.8 do not redact the keyserver bearer token passed as the positional argument to 'keyserver set-token' in the --debug argv dump, because sanitizeargvfordebug fails to sanitize it. As a result the token is printed in cleartext to stderr unde...

PT-2026-82596

openssl encrypt versions before 1.4.9 fail to escape attacker-controlled key id values printed to stderr during decrypt auto-detection. Attackers can craft encrypted files with malicious key id containing escape sequences to repaint terminal output and forge authenticity verification blocks...

PT-2026-82594

Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.9 Description The software fails to validate the total field within QR JSON payloads before materializing ranges. An attacker can provide specially crafted QR images containing extremely large values in th...

PT-2026-85187

openssl encrypt pip package openssl-encrypt versions 1.4.8 and earlier store an mTLS client private key in cleartext within a world-readable 0644 SharedPreferences file via the desktop GUI's Settings screen 'combined certificate and private key' PEM field. A local attacker with file system access...

PT-2026-82612

openssl encrypt pip package openssl-encrypt before 1.4.9 contains two weaknesses in the portable USB drive feature, whose threat model treats the removable drive as untrusted attacker with physical write access. USBDriveCreator. verify integrity file only validates files listed in the manifest, s...

PT-2026-82584

openssl encrypt pip package openssl-encrypt versions 1.4.8 and earlier store an mTLS client private key in cleartext within a world-readable 0644 SharedPreferences file via the desktop GUI's Settings screen 'combined certificate and private key' PEM field. A local attacker with file system access...

PT-2026-85195

openssl encrypt pip: openssl-encrypt versions before 1.4.9 contain a path traversal flaw in PluginSandbox. is safe path, which authorized file access using a bare string-prefix match. A sandboxed plugin without the READ FILES permission could read or write another plugin's directory that merely...

CVE-2026-81694: Improper Output Neutralization for Logs

openssl-encrypt pip package, versions = 1.4.8 fails to sanitize filenames read from untrusted drive data outside the AES-GCM authenticated manifest before printing them in the verify-usb command's output. An attacker can plant filenames containing terminal cursor-movement and erase-line control...

PT-2026-82607

Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.9 Description The software fails to prevent namespace collisions between own identities and contacts within the IdentityStore. This allows attackers to create shadowed contact entries that remain invisible...

PT-2026-85189

openssl encrypt 1.4.x before 1.4.9 contains an optional D-Bus crypto service whose org.freedesktop.DBus.Properties.Set method performs neither a polkit authorization check nor value validation. Any local user on the system bus can call Set without authorization and set MaxConcurrentOperations to...

PT-2026-82613

Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.9 Description The software uses under-parameterized PBKDF2-HMAC-SHA256, a key derivation function, with insufficient iteration counts: 100,000 iterations for protecting PQC keyfile private keys and 10,000...

PT-2026-82608

Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.9 Description The software fails to sanitize the email field of imported identity documents. This allows attackers to inject ANSI escape sequences—special codes used to control terminal formatting—to forge...

PT-2026-82604

Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.9 Description The software fails to validate the encryption status of embedded post-quantum cryptography PQC private keys within file metadata. This allows attackers to create files containing unencrypted...

PT-2026-82606

Name of the Vulnerable Software and Affected Versions openssl-encrypt versions prior to 1.4.9 Description The software fails to redact file passwords in the --debug argv dump when passwords are provided using bundled short-option spellings e.g., -apHunter2 or abbreviated long-option spellings e.g...