medium6.2
CVE-2026-81720
openssl_encrypt before 1.4.9 fails to validate the memory_cost parameter from identity file protection blocks, allowing attackers to trigger out-of-memory cond…
Impact
openssl_encrypt before 1.4.9 fails to validate the memory_cost parameter from identity file protection blocks, allowing attackers to trigger out-of-memory conditions during key derivation. Attackers with write access to local identity stores can craft malicious identity files with excessive memory_cost values that cause the host to crash when unlocking identities before authentication.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jahlives | Openssl Encrypt | before 1.4.9 |