What’s Vulnerable › Vulnerabilities

CVE-2026-34054: openssl on Windows built with openssldir set from the build machine (Uncontrolled Search Path Element)

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-31 · updated 2026-06-17
• Weakness: CWE-427

Description

vcpkg is a free and open-source C/C++ package manager. Prior to version 3.6.1#3, vcpkg's Windows builds of OpenSSL set openssldir to a path on the build machine, making that path be attackable later on customer machines. This issue has been patched in version 3.6.1#3.

Affected products

• microsoft vcpkg: before 3.6.1#3

References

• https://github.com/microsoft/vcpkg/commit/5111afdf55cc1429d9951e4c7b02010e659346a9
• https://github.com/microsoft/vcpkg/pull/50518
• https://github.com/microsoft/vcpkg/security/advisories/GHSA-p322-v6vw-vrq9

Get alerted when CVE-2026-34054 or the next vulnerability affects your stack