CVE-2026-81707

openssl_encrypt before 1.4.9 fails to sanitize the email field of imported identity documents, allowing ANSI escape sequences embedded in that field to pass through to the user's terminal. An attacker delivers a crafted identity bundle through normal contact-exchange flows or keyserver responses; when the imported document is displayed, the escape sequences manipulate the terminal output so the fingerprint verification line shows a fingerprint of the attacker's choosing. This lets the attacker make a substituted key appear to match the expected fingerprint, defeating the out-of-band verification mechanism that protects against key-substitution attacks. Anyone running an affected version of openssl_encrypt who imports or displays identity documents obtained from other parties is exposed. No public proof-of-concept or known in-the-wild exploitation has been reported; EPSS currently estimates a 0.4% probability of exploitation within 30 days.

What to do: Upgrade to openssl_encrypt 1.4.9 or later. Until patched, verify fingerprints by re-deriving them from the key material over a trusted channel rather than trusting the terminal-displayed verification line, and treat identity bundles or keyserver responses from untrusted sources with caution. As an interim mitigation, view imported documents through a terminal filter that strips ANSI escape sequences.