CVE-2026-81718 in openssl_encrypt
Summary
by MITRE • 08/27/2026
openssl_encrypt versions before 1.4.9 use under-parameterized PBKDF2-HMAC-SHA256 with only 100,000 iterations to protect PQC keyfile private keys and 10,000 iterations for dual-encryption file-password verification. Attackers who obtain keyfiles or encrypted files can brute-force wrapping passwords offline using GPU or ASIC acceleration.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability in openssl_encrypt versions prior to 1.4.9 centers on the implementation of Password-Based Key Derivation Function 2, specifically utilizing HMAC-SHA256 for deriving cryptographic keys from user-supplied passwords. The core technical flaw lies in the configuration of iteration counts used during this key derivation process, which are significantly lower than current security recommendations for protecting sensitive data against offline brute-force attacks. Specifically, the library employs only one hundred thousand iterations to protect Post-Quantum Cryptography (PQC) keyfile private keys and ten thousand iterations for dual-encryption file-password verification mechanisms. This under-parameterization creates a substantial weakness in the computational cost required to test each password guess, thereby reducing the effective security margin provided by strong passwords.
From an operational perspective, this misconfiguration exposes users to severe risks if their encrypted files or keyfiles are compromised through theft, data breaches, or unauthorized access. Because the iteration counts are low, attackers equipped with modern hardware acceleration technologies such as Graphics Processing Units (GPUs) or Application-Specific Integrated Circuits (ASICs) can perform password guessing at an exceptionally high rate. This capability allows adversaries to conduct offline brute-force attacks that may successfully recover weak or even moderately strong passwords within a feasible timeframe. The impact is particularly critical for PQC keyfiles, as the compromise of these keys could undermine the integrity and confidentiality guarantees expected from post-quantum cryptographic systems, potentially exposing long-term sensitive communications or data stored using these advanced algorithms.
This vulnerability aligns with CWE-757, which describes the use of a one-way function without an appropriate iteration count for password hashing or key derivation. It also relates to CWE-916 regarding the use of a weak algorithm in a cryptographic context, as the chosen parameters fail to meet contemporary standards for resistance against brute-force attacks. In terms of adversary tactics, this flaw facilitates techniques associated with MITRE ATT&CK Tactic TA0006, specifically Credential Access, and more precisely aligns with sub-techniques involving offline password cracking or dictionary attacks where computational efficiency is leveraged to bypass authentication controls. The lack of sufficient work factor means that the defense in depth provided by encryption is effectively neutralized if the underlying key derivation process does not impose a meaningful time cost on attackers.
To mitigate this vulnerability, organizations and developers must upgrade openssl_encrypt to version 1.4.9 or later, where these iteration counts have been increased to align with current best practices for password-based key derivation. For systems that cannot be immediately upgraded, it is advisable to implement application-level wrappers that enforce stronger key derivation parameters before passing data to the library, although this introduces complexity and potential points of failure. Additionally, enforcing strict password policies that require high entropy can provide a secondary layer of defense by making brute-force attacks computationally prohibitive even with accelerated hardware. Regular audits of cryptographic configurations against standards such as NIST SP 800-132 are recommended to ensure that iteration counts remain adequate relative to advances in computational power and attack methodologies.