External risk intelligence

openssl_encrypt key_id terminal injection vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-81695

This vulnerability is related to terminal output rendering triggered by local processing of files. It requires a user to manually decrypt or process a malicious file, which then prints crafted output to their local console. It does not involve a network-facing service, API, or remotely reachable infrastructure.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists in certain versions of openssl_encrypt related to how it handles specific identifiers during decryption, potentially allowing malicious data to alter terminal displays and falsify verification information. This could present an attacker with an opportunity to mislead users or systems by manipulating output that appears to confirm authenticity.

Cryptographic tool can be tricked to alter terminal output.
Misleading output could forge authenticity verification blocks.
Confirming relevance and exposure is the primary leadership concern.

Attack Path

How an attacker could exploit the issue

An attacker could craft a file with a specially designed key ID that, when processed by a vulnerable version of openssl_encrypt, would cause the program to print malicious escape sequences to the terminal. This could allow the attacker to manipulate the terminal's display, potentially forging output that appears to be a legitimate verification or leading to other unexpected terminal behaviors.

Attacker crafts a malicious file.
Vulnerable software processes the file.
Terminal output is manipulated.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, an attacker could craft encrypted files with malicious `key_id` values that contain escape sequences. This could allow them to repaint terminal output and forge authenticity verification blocks when the affected software attempts to decrypt such files.

Malicious terminal output.
Crafted encrypted files trigger escape sequences.
Forged authenticity verification blocks.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects the `openssl_encrypt` utility when processing crafted encrypted files, allowing for terminal output manipulation. Responsibility likely lies with application owners and infrastructure teams managing the utility. The immediate practical step is to identify all instances of `openssl_encrypt` before version 1.4.9, confirm their exposure, and assess the business criticality of affected systems to prioritize remediation.

Application and infrastructure teams own remediation.
Verify all `openssl_encrypt` instances before 1.4.9.
Plan targeted updates or risk mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is openssl_encrypt?

openssl_encrypt is a software utility designed to handle cryptographic operations, specifically for encrypting and decrypting data. It serves as a tool for securing information and verifying authenticity. Developers and system administrators use it to manage encrypted files, often relying on its ability to identify key IDs during the decryption process to ensure files are handled by the correct cryptographic keys.

What is the vulnerability in CVE-2026-81695?

This CVE involves a weakness known as Improper Output Neutralization for Logs, or CWE-117. The utility fails to properly filter special characters within key_id values before printing them to the terminal. By injecting specific escape sequences into an encrypted file's metadata, an attacker can manipulate the terminal display to forge fake verification messages, potentially misleading someone into believing a malicious file is authentic.

How is this vulnerability triggered?

An attacker must craft a malicious encrypted file containing a specially designed key_id string. The vulnerability is triggered when a user or automated process uses a vulnerable version of openssl_encrypt to decrypt or analyze that specific file. It is not triggered by simply having the software installed, nor does it affect files that do not contain these malicious, specially crafted key_id escape sequences.

Do I need to worry if openssl_encrypt is not internet-facing?

According to Halo Surface Signal, this vulnerability is very unlikely to pose a risk in typical network-exposed scenarios. Because the issue involves manipulating local terminal output, it requires the manual or local processing of a malicious file. It does not exploit a network service or remotely reachable API, meaning the primary risk is limited to local interactions rather than direct network-based attacks.

How do I fix the CVE-2026-81695 vulnerability?

The primary response is to update your software. Identify all systems or applications in your environment running any version of openssl_encrypt prior to 1.4.9. Once identified, prioritize upgrading these instances to version 1.4.9 or later, where the issue of improperly escaped terminal output has been addressed.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.