CVE-2026-81682 in openssl_encrypt
Summary
by MITRE • 08/27/2026
openssl_encrypt versions before 1.4.9 contain an insecure file permissions vulnerability in the desktop GUI that writes decrypted plaintext with world-readable default permissions. Attackers can read decrypted output files created by the GUI as unprivileged local users on multi-user systems.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/27/2026
The OpenSSL Encrypt application, specifically prior to version 1.4.9 for its desktop graphical user interface variant, suffers from a critical insecure file permission vulnerability that compromises the confidentiality of sensitive data during decryption operations. This flaw stems from improper default access control settings applied when the software writes decrypted plaintext files to the local filesystem. Instead of restricting write permissions to only the invoking user or applying restrictive defaults such as owner-only read and write rights, the application creates output files with world-readable permissions by default. In Unix-like operating systems and many Windows configurations, this means that any authenticated user on a multi-user system can access the contents of these decrypted files without requiring elevated privileges or specific authorization from the file owner.
From a technical perspective, this vulnerability represents a classic failure in secure coding practices regarding resource management and data protection at rest. When an application generates temporary or output files containing sensitive information, it is imperative to enforce strict least-privilege access controls immediately upon creation. The absence of such controls allows for unauthorized disclosure of plaintext data that was intended to remain confidential. This issue is particularly severe in shared computing environments where multiple users interact with the same system, as well as on personal computers used by families or small teams where distinct user accounts may share a machine but expect privacy regarding their individual cryptographic operations.
The operational impact of this vulnerability allows unprivileged local attackers to read decrypted output files created by other users through the OpenSSL Encrypt GUI. An attacker who gains access to the system, even with minimal privileges such as those granted to standard guest or secondary accounts, can navigate to the directory where decryption outputs are stored and view their contents. This leads directly to a breach of confidentiality for any sensitive data processed using this tool, including private keys, encrypted documents, passwords, or proprietary information that was secured via encryption before being decrypted by another user on the same host.
This vulnerability aligns with CWE-732: Incorrect Permission Assignment for Critical Resource within the Common Weakness Enumeration taxonomy. It also maps to ATT&CK technique T1550.004: Steal or Forge Web Cookies, although in this context it is more broadly applicable to stealing any sensitive file content rather than just cookies, falling under lateral movement or credential access vectors depending on the data type. The core issue lies in the misconfiguration of operating system-level security controls by the application itself during runtime execution.
To mitigate this vulnerability, users should upgrade OpenSSL Encrypt to version 1.4.9 or later where these permission defaults have been corrected to enforce restrictive access rights appropriate for sensitive plaintext files. In environments where upgrading is not immediately feasible, administrators can implement compensating controls such as configuring file system permissions through group policies or mandatory access control systems like SELinux or AppArmor to restrict read access to specific directories containing decrypted outputs. Additionally, users should be advised to manually verify the permissions of newly created decryption output files and delete them securely once they are no longer needed, ensuring that residual data does not remain accessible to other system users.