CVE-2026-81718

Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.9

Description The software uses under-parameterized PBKDF2-HMAC-SHA256, a key derivation function, with insufficient iteration counts: 100,000 iterations for protecting PQC keyfile private keys and 10,000 iterations for dual-encryption file-password verification. This allows attackers who obtain keyfiles or encrypted files to perform offline brute-force attacks on wrapping passwords using GPU or ASIC acceleration.

Recommendations Update openssl encrypt to version 1.4.9 or later.