CVE-2026-34054

Description

vcpkg is a free and open-source C/C++ package manager. Prior to version 3.6.1#3, vcpkg's Windows builds of OpenSSL set openssldir to a path on the build machine, making that path be attackable later on customer machines. This issue has been patched in version 3.6.1#3.

PUBLISHED Reserved 2026-03-25 | Published 2026-03-31 | Updated 2026-04-02 | Assigner GitHub_M

Problem types

CWE-427: Uncontrolled Search Path Element

Product status

References

github.com/.../vcpkg/security/advisories/GHSA-p322-v6vw-vrq9

github.com/microsoft/vcpkg/pull/50518

github.com/...ommit/5111afdf55cc1429d9951e4c7b02010e659346a9

cve.org (CVE-2026-34054)

nvd.nist.gov (CVE-2026-34054)

Download JSON