Vulnerability · Published Mar 31, 2026 · Assigned by GitHub_M
CVE-2026-34054openssl on Windows built with openssldir set from the build machine (Uncontrolled Search Path Element)
High 7.8
In plain English
A high-severity uncontrolled search path in vcpkg from microsoft. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities).
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.7%top 45.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
vcpkg is a free and open-source C/C++ package manager. Prior to version 3.6.1#3, vcpkg's Windows builds of OpenSSL set openssldir to a path on the build machine, making that path be attackable later on customer machines. This issue has been patched in version 3.6.1#3.
Affected products (as reported)
Weakness: CWE-427 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/microsoft/vcpkg/security/advisories/GHSA-p322-v6vw-vrq9 x_refsource_CONFIRM
- https://github.com/microsoft/vcpkg/pull/50518 x_refsource_MISC
- https://github.com/microsoft/vcpkg/commit/5111afdf55cc1429d9951e4c7b02010e659346a9 x_refsource_MISC