CVE-2026-81720 in openssl_encrypt
Summary
by MITRE • 08/27/2026
openssl_encrypt before 1.4.9 fails to validate the memory_cost parameter from identity file protection blocks, allowing attackers to trigger out-of-memory conditions during key derivation. Attackers with write access to local identity stores can craft malicious identity files with excessive memory_cost values that cause the host to crash when unlocking identities before authentication.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability in OpenSSL versions prior to 1.4.9 centers on a critical input validation failure within the mechanism used for protecting identity file credentials, specifically regarding the derivation of cryptographic keys from user-provided passwords or passphrases. The function openssl_encrypt is responsible for handling various encryption tasks, but in this specific context, it interacts with parameters that dictate resource consumption during key derivation processes such as PBKDF2 or similar algorithms. When an application utilizes OpenSSL to unlock local identity stores, it must parse configuration blocks within the identity file that specify security parameters including memory_cost, which determines the amount of RAM allocated for the hashing operation to resist brute-force attacks. The flaw lies in the absence of rigorous bounds checking on this memory_cost parameter before it is passed to the underlying cryptographic routines. This oversight allows an attacker who possesses write access to local identity stores to inject a maliciously crafted value that exceeds reasonable limits or system capabilities, thereby bypassing intended resource constraints designed to prevent denial-of-service conditions through excessive computational load.
From a technical perspective, this flaw represents a classic case of improper input validation leading to resource exhaustion. When the openssl_encrypt function processes an identity file with an excessively large memory_cost parameter, it attempts to allocate a corresponding amount of system memory for the key derivation process. Since there is no upper limit enforced on this allocation request before execution begins, the operating system may be forced to commit more physical or virtual memory than is available. This triggers out-of-memory conditions that can cause the application handling the identity store to crash abruptly. In many systems, such crashes are not isolated; they can lead to instability in dependent services or trigger automatic restarts of critical authentication daemons. The operational impact is significant because it allows for a local denial-of-service attack where an authenticated user with file write permissions can disrupt system availability by simply modifying their own identity configuration files. This undermines the reliability and resilience of systems that rely on these identity stores for secure access control, particularly in environments requiring high uptime or continuous authentication services.
This vulnerability aligns closely with CWE-400, which describes Uncontrolled Resource Consumption, as well as CWE-789, which pertains to Memory Allocation with Excessive Size Value. The attack vector is classified under Local Privileges because it requires the attacker to have write access to local identity stores, meaning they must already be authenticated or have compromised a user account on the system. In terms of MITRE ATT&CK framework mapping, this behavior corresponds to T1496 Resource Hijacking, specifically through resource exhaustion techniques that degrade service availability rather than stealing data directly. The attacker leverages their existing access to exhaust system resources, effectively creating a denial-of-service condition without needing elevated privileges or network-based exploitation capabilities. This makes the vulnerability particularly dangerous in multi-user environments where privilege escalation is not required for initial impact, although it does require some level of local file system access.
Mitigation strategies must focus on both immediate patching and long-term defensive coding practices. The primary remediation is to upgrade OpenSSL to version 1.4.9 or later, which includes the necessary validation logic to ensure that memory_cost values fall within acceptable bounds before being processed by key derivation functions. For systems where upgrading immediately is not feasible, administrators should implement strict file integrity monitoring on identity store directories to detect unauthorized modifications to configuration files containing these parameters. Additionally, operating system-level resource controls such as cgroups in Linux or Job Objects in Windows can be configured to limit the maximum memory usage for specific processes handling authentication services, providing a layer of defense-in-depth that prevents any single process from exhausting all available system memory. Developers integrating OpenSSL should also enforce application-layer validation by sanitizing input parameters before passing them to cryptographic libraries, ensuring that resource-intensive operations are capped at safe thresholds regardless of library updates.