Weak Key Derivation in OpenSSL_Encrypt D-Bus CryptoService by OpenSSL

CVE-2026-81704

What is CVE-2026-81704?

The OpenSSL_Encrypt component prior to version 1.4.9 contains a vulnerability stemming from the use of unstretched SHA-256 in its D-Bus CryptoService.EncryptFile handler. This allows attackers to exploit the absence of adequate key stretching, significantly increasing the feasibility of offline password guessing attacks. The inefficiency in the original implementation can lead to a drastic reduction in the time required for successful breaches, enabling compromised encrypted files due to insufficiently secure password handling.

References