A vulnerability in Microsoft vcpkg allows attackers to exploit an uncontrolled search path element in OpenSSL builds, posing a risk of full system compromise.

This is an uncontrolled search path element (CWE-427) flaw where the openssldir path is incorrectly set to a location on the build machine. A local, authenticated attacker can leverage this misconfiguration to gain unauthorized control over affected systems.

The vulnerability carries a CVSS score of 7.8, indicating a high severity risk. Successful exploitation allows an attacker to achieve total technical impact, potentially leading to unauthorized data access, system modification, or complete service disruption. Because this affects the build and deployment pipeline for C/C++ projects, it could facilitate supply chain attacks if not remediated.

Immediate Action: Upgrade Microsoft vcpkg to version 3.6.1#3 or later to correct the openssldir configuration.

Proactive Monitoring: Monitor system logs for unexpected file access or directory traversal attempts within the vcpkg installation paths.

Compensating Controls: Ensure that build environments are isolated and that users have the principle of least privilege applied to prevent unauthorized access to build-time directories.

Public Exploit Available: No.

Given the high CVSS score and the potential for total system impact, organizations should prioritize updating their vcpkg instances immediately. Failure to patch allows local users to potentially escalate privileges by exploiting the predictable search path behavior introduced during the OpenSSL build process.