openssl_encrypt ANSI Escape Injection Fingerprint Spoofing (CVE-2026-81707)

Technical Analysis

The vulnerability stems from insufficient input sanitization of the email field within imported identity bundles, permitting embedded ANSI/VT100 escape sequences to manipulate terminal rendering. When a crafted identity is imported via contact exchange or a malicious keyserver response, the escape sequences can overwrite, hide, or replace the displayed fingerprint with an attacker-chosen value, defeating manual fingerprint comparison used for key authentication. This is a terminal output injection attack rather than a cryptographic break, but its impact is equivalent to a key substitution/MITM enabler since victims may unknowingly encrypt data to or trust signatures from an attacker's key. The CVSS 9.8 rating reflects the low complexity of exploitation (no authentication or interaction beyond normal contact/key import workflows) and the high-impact consequence of full trust-model compromise. AI agent systems that automate PGP/S-MIME key import, identity verification, or secure messaging (e.g., agents managing encrypted communications, credential exchange, or automated trust bootstrapping) could be tricked into displaying or logging spoofed fingerprints, leading to agents establishing encrypted channels with attacker-controlled keys and subsequent exposure of secrets or API keys transmitted over those channels.

Affected Systems

openssl_encrypt library and any application/tool embedding it for identity document import prior to version 1.4.9; PGP/S-MIME clients, keyservers, and CLI/terminal-based verification tools relying on this library for fingerprint display; any automation or agent pipeline that parses identity bundles and renders fingerprint strings to terminal or log output.

Indicators of Compromise

• No specific malware hashes, IPs, or domains identified (vulnerability is a code-level input validation flaw, not a distributed campaign)
• Malicious identity bundles/keyserver responses containing ANSI escape sequences (e.g., \x1b[ sequences) embedded in the email field
• Anomalous terminal control characters observed in imported PGP identity documents or keyserver query responses

Remediation Steps

1. 1

   Upgrade openssl_encrypt

   Update to version 1.4.9 or later, which sanitizes identity document fields before terminal display.

2. 2

   Sanitize terminal output

   Strip or escape non-printable and ANSI control characters from all user-supplied fields (email, name, comment) before rendering fingerprint verification lines.

3. 3

   Independently verify fingerprints

   Cross-check fingerprints through a secondary trusted channel (e.g., voice call, signed website) rather than relying solely on terminal-displayed output during the vulnerable window.

4. 4

   Audit automated key-import pipelines

   Review AI agents, bots, or scripts that automatically import identities or keys from keyservers/contact exchanges to ensure they do not blindly trust displayed fingerprints without raw-byte validation.

5. 5

   Monitor and filter keyserver responses

   Implement input filtering at the network/application layer to detect and strip ANSI escape sequences in incoming identity bundle data before processing.