CVE-2026-81706 - openssl_encrypt before 1.4.9 fails to prevent namespace collisions between own identities and contacts in IdentityStore, allowing attackers to create shadowed contact entries invisible until the corresponding own identity is deleted. When the own identity is deleted, the shadowed contact becomes visible and resolves to the attacker's keys, enabling silent key substitution for encrypted files. - 漏洞详情

漏洞编号：CVE-2026-81706

风险等级：中危

漏洞来源：CVE

CVE 编号：CVE-2026-81706

CNNVD 编号：-

厂商/产品：- / -

影响范围：-

CWE：CWE-345

发布/更新时间：2026-08-27 / 2026-08-28

漏洞描述

openssl_encrypt before 1.4.9 fails to prevent namespace collisions between own identities and contacts in IdentityStore, allowing attackers to create shadowed contact entries invisible until the corresponding own identity is deleted. When the own identity is deleted, the shadowed contact becomes visible and resolves to the attacker's keys, enabling silent key substitution for encrypted files.

漏洞描述

相关链接

相关漏洞