CVE-2026-81704 in openssl_encrypt
Summary
by MITRE • 08/27/2026
openssl_encrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler that uses unstretched SHA-256 instead of Argon2id. Attackers can perform offline password guessing against encrypted files roughly six to seven orders of magnitude faster than documented protection by exploiting the missing key stretching and hash rounds.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability identified in OpenSSL Encrypt versions prior to 1.4.9 represents a critical failure in cryptographic implementation within the D-Bus CryptoService.EncryptFile handler. This flaw stems from an incorrect choice of key derivation function, specifically the use of unstretched SHA-256 hashing instead of a modern password-based key derivation algorithm such as Argon2id. In secure systems, when encrypting files protected by passwords or passphrases, it is imperative to derive encryption keys using algorithms that are computationally expensive and memory-hard. This design ensures that each guess requires significant processing time and resources, thereby neutralizing brute-force attacks. By relying on SHA-256 without any stretching mechanism like PBKDF2, bcrypt, scrypt, or Argon2, the system fails to impose a meaningful computational cost on password verification attempts. Consequently, the derived keys are generated instantly for every attempted password, leaving the encrypted data exposed to rapid offline analysis.
The operational impact of this vulnerability is severe due to the magnitude of performance disparity between weak and strong key derivation methods. Attackers can perform offline password guessing against files encrypted with this flawed implementation approximately six to seven orders of magnitude faster than what would be expected from a properly secured system. This means that while a secure configuration might take years or decades to crack a complex password through brute force, the vulnerable version allows for millions or billions of guesses per second on modern hardware. The lack of hash rounds and memory-hardening features eliminates the primary defense against dictionary attacks and rainbow table precomputation techniques. As a result, even passwords with moderate complexity can be recovered in minutes or hours rather than years, effectively rendering the encryption useless for protecting sensitive data from determined adversaries who have access to the encrypted files.
From a classification perspective, this vulnerability aligns closely with CWE-759, which describes the use of a one-way hash without salt, and more specifically CWE-916 regarding the use of a weak key derivation function in an authentication scheme. The exploitation technique falls under MITRE ATT&CK tactic T1110, specifically subtechnique T1110.001 for Brute Force attacks. Because the attack vector involves offline password guessing against stored encrypted data, it also relates to CWE-327 on the use of a broken or risky cryptographic algorithm. The absence of key stretching means that standard defenses such as account lockout policies are ineffective since the attacker operates entirely outside the application's runtime environment after obtaining the ciphertext and associated metadata. This allows for parallelized attacks across multiple GPUs or distributed computing clusters without triggering any detection mechanisms inherent to online authentication systems.
Mitigation strategies must focus on immediate remediation of the cryptographic implementation within the D-Bus CryptoService.EncryptFile handler. The primary corrective action is to upgrade OpenSSL Encrypt to version 1.4.9 or later, where this vulnerability has been addressed by implementing a robust key derivation function such as Argon2id. If upgrading is not immediately feasible, temporary mitigations should include enforcing extremely high-complexity password policies with significant length requirements to increase the entropy space, although this does not fully resolve the underlying technical flaw. Additionally, organizations should audit their data storage practices to ensure that encrypted files are protected by additional layers of security, such as full-disk encryption or hardware-based key management systems like HSMs, which can provide defense-in-depth against offline attacks. Regular cryptographic audits and penetration testing focused on authentication mechanisms are essential to identify similar weaknesses in other components before they can be exploited.