Skip to content
OpenAdvisories
High · 7.8 CVE-2026-34054 EUVD-2026-17285

openssl on Windows built with openssldir set from the build machine (Uncontrolled Search Path Element)

Published Mar 31, 2026 · Updated Apr 2, 2026 · Assigned by GitHub_M

Description

vcpkg is a free and open-source C/C++ package manager. Prior to version 3.6.1#3, vcpkg's Windows builds of OpenSSL set openssldir to a path on the build machine, making that path be attackable later on customer machines. This issue has been patched in version 3.6.1#3.

Affected products

VendorProductAffectedFixed
microsoft vcpkg < 3.6.1#3 —

References