ANSI Escape Injection Vulnerability in OpenSSL Encrypt by OpenSSL

CVE-2026-81707

What is CVE-2026-81707?

The OpenSSL Encrypt component prior to version 1.4.9 is vulnerable to an ANSI escape injection due to improper sanitization of the email field in imported identity documents. This flaw allows malicious actors to include crafted identity bundles via standard contact exchange methods or keyserver responses, leading to potential manipulation of terminal output. By exploiting this vulnerability, attackers can display fraudulent fingerprints that mislead users into believing they are verifying legitimate keys, circumventing essential out-of-band verification processes designed to protect against key substitution attacks.

References