openssl_encrypt before 1.4.9 executes untrusted third-party plugins with insufficient controls: the plugin signature policy defaulted to WARN, so an unsigned/un…

CVE-2026-81719 affects openssl_encrypt versions prior to 1.4.9, where third-party plugins were executed with insufficient security controls. The plugin signature policy defaulted to WARN instead of ENFORCE, allowing unsigned or unverifiable non-built-in plugins to be compiled and executed in the host process at import time, before the runtime sandbox was installed. The only default protection was an incomplete and bypassable AST denylist. If a user is induced to load a malicious plugin, an attacker can achieve arbitrary code execution with the privileges of the user running openssl_encrypt. The vulnerability has been fixed in version 1.4.9 by changing the default signature policy to ENFORCE for non-built-in plugins, preventing unsigned plugins from executing without explicit user approval.