Nixpkgs security tracker

Dismissed

Permalink CVE-2026-34054

7.8 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 1 month, 3 weeks ago by @LeSuisse Activity log

Created suggestion 1 month, 3 weeks ago
@LeSuisse dismissed 1 month, 3 weeks ago

openssl on Windows built with openssldir set from the build machine (Uncontrolled Search Path Element)

vcpkg is a free and open-source C/C++ package manager. Prior to version 3.6.1#3, vcpkg's Windows builds of OpenSSL set openssldir to a path on the build machine, making that path be attackable later on customer machines. This issue has been patched in version 3.6.1#3.

References

https://github.com/microsoft/vcpkg/security/advisories/GHSA-p322-v6vw-vrq9 x_refsource_CONFIRM
https://github.com/microsoft/vcpkg/pull/50518 x_refsource_MISC
https://github.com/microsoft/vcpkg/commit/5111afdf55cc1429d9951e4c7b02010e659346a9 x_refsource_MISC

Affected products

vcpkg

==< 3.6.1#3

Matching in nixpkgs

pkgs.vcpkg

C++ Library Manager for Windows, Linux, and macOS

nixos-unstable 2026.01.16
- nixpkgs-unstable 2026.01.16
- nixos-unstable-small 2026.01.16
nixos-25.11 2025.10.17
- nixos-25.11-small 2025.10.17
- nixpkgs-25.11-darwin 2025.10.17

pkgs.vcpkg-tool

Components of microsoft/vcpkg's binary

nixos-unstable 2025-12-16
- nixpkgs-unstable 2025-12-16
- nixos-unstable-small 2025-12-16
nixos-25.11 2025-10-16
- nixos-25.11-small 2025-10-16
- nixpkgs-25.11-darwin 2025-10-16

pkgs.vcpkg-tool-unwrapped