CVE-2026-34054

Published: Mar 31, 2026 Last Modified: Mar 31, 2026
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 7,8
Source: [email protected]
Attack Vector: local
Attack Complexity: low
Privileges Required: low
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high

Description

AI Translation Available

vcpkg is a free and open-source C/C++ package manager. Prior to version 3.6.1#3, vcpkg's Windows builds of OpenSSL set openssldir to a path on the build machine, making that path be attackable later on customer machines. This issue has been patched in version 3.6.1#3.

427

Uncontrolled Search Path Element

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Confidentiality Integrity Availability
Potential Impacts:
Execute Unauthorized Code Or Commands
Applicable Platforms
All platforms may be affected
View CWE Details
https://github.com/microsoft/vcpkg/commit/5111afdf55cc1429d…
https://github.com/microsoft/vcpkg/commit/5111afdf55cc1429d9951e4c7b02010e65934…
https://github.com/microsoft/vcpkg/pull/50518
https://github.com/microsoft/vcpkg/pull/50518
https://github.com/microsoft/vcpkg/security/advisories/GHSA…
https://github.com/microsoft/vcpkg/security/advisories/GHSA-p322-v6vw-vrq9