PT-2026-82605 · Unknown · Openssl-Encrypt
CVE-2026-81704
·
Published
2026-08-27
·
Updated
2026-09-03
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
openssl encrypt versions prior to 1.4.9
Description
The D-Bus CryptoService.EncryptFile handler uses unstretched SHA-256 instead of Argon2id for key derivation. This allows attackers to perform offline password guessing against encrypted files significantly faster than the documented protection by exploiting the absence of key stretching and hash rounds.
Recommendations
Update to version 1.4.9 or later.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Openssl-Encrypt