CVE-2026-34054

Name of the Vulnerable Software and Affected Versions vcpkg versions prior to 3.6.1#3

Description vcpkg, a C/C++ package manager, exhibited a configuration issue in its Windows builds of OpenSSL. Specifically, the openssldir setting was configured to a path on the build machine. This configuration could potentially allow for attacks on customer machines. The issue was addressed with version 3.6.1#3.

Recommendations Update to vcpkg version 3.6.1#3 or later.