VulnSocial

CVE-2026-34054Disclosure

LOWCVSS 7.8 · HIGH

Signal is active with 4 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

vcpkg is a free and open-source C/C++ package manager. Prior to version 3.6.1#3, vcpkg's Windows builds of OpenSSL set openssldir to a path on the build machine, making that path be attackable later on customer machines. This issue has been patched in version 3.6.1#3.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-427

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

  • Patch or workaround signal is available
  • 4 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 3 signals
  • Disclosure: 2 classified signals
  • General: 1 classified signal
  • 4 total mentions across 1 day

Deep dive

Activity timeline4 mentions / 1d
01234Mentions · 2026-03-31: 4Patch / Workaround · 2026-03-31: 1Technical Details · 2026-03-31: 303-31
Signal classification3 categories
Disclosure
250.0%
General
125.0%
Patch
125.0%
Referenced assets7 URLs
Full discourse4 posts
  • dbugs@ptdbugs
    Patch

    openssl on Windows built with openssldir set from the build machine (Uncontrolled Search Path Element) CVE: CVE-2026-34054 Vendor: Microsoft Product: vcpkg CVSS: 7.8 Credits: n/a Description: vcpkg is a free and open-source C/C++ package manager. Prior to version 3.6.1#3, vcpkg's Windows builds of OpenSSL set openssldir to a path on the build machine, making that path be attackable later on customer machines. This issue has been patched in version 3.6.1#3. References: • https://dbugs.ptsecurity.com/vulnerability/CVE-2026-34054 • https://github.com/microsoft/vcpkg/security/advisories/GHSA-p322-v6vw-vrq9 • https://github.com/microsoft/vcpkg/pull/50518 • https://github.com/microsoft/vcpkg/commit/5111afdf55cc1429d9951e4c7b02010e659346a9 #dbugs_vuln

    Post summary

    VCPKG's Windows OpenSSL builds previously set openssldir to a build‑machine path, creating an uncontrolled search path flaw; the issue is resolved with the 3.6.1#3 release.

    01011164
    781 followersView on X
  • CVEarity@CVEarity
    General

    ⚡ New CVE Alert: CVE-2026-34054 📊 Severity: 7.8 🚨 Risk Level: High 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-34054 #CVE-2026-34054 #CVE #High #CyberSecurity #InfoSec https://t.co/l0NKwmGROF

    Post summary

    The tweet announces CVE-2026-34054 with a severity score and a link to the NVD entry, but it does not provide technical details, PoC, exploit, or remediation information.

    0001024
    123 followersView on X
  • 0day Signal@0dayPublishing
    Disclosure

    ⚠️ CVE-2026-34054: openssl on Windows built with o... vcpkg's hardcoded build machine paths in OpenSSL configs create trivial local privilege escalation vectors on every Win... https://zerodaysignal.com/vulnerability/CVE-2026-34054 #netsec #vulnerability #CVE #sysadmin #zeroday

    Post summary

    The post announces CVE-2026-34054, noting that OpenSSL on Windows built with vcpkg contains hardcoded paths that allow trivial local privilege escalation.

    0001073
    194 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-34054 vcpkg is a free and open-source C/C++ package manager. Prior to version 3.6.1#3, vcpkg's Windows builds of OpenSSL set openssldir to a path on the build machine, maki… https://www.cve.org/CVERecord?id=CVE-2026-34054

    Post summary

    The post highlights CVE‑2026‑34054 in vcpkg’s OpenSSL builds, noting a misconfigured openssldir path, but provides no PoC, exploit code, patch, or evidence of active exploitation.

    0000096
    56.9K followersView on X

Explore more

Back to dashboard