vcpkg vulnerabilities

1 known vulnerability in vcpkg from Microsoft. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.8 High severity

  vcpkg: Uncontrolled Search Path Element

  CVE-2026-34054Mar 31, 2026Microsoft

  vcpkg is a free and open-source C/C++ package manager. Prior to version 3.6.1#3, vcpkg's Windows builds of OpenSSL set openssldir to a path on the build machine, making that path be attackable later on customer machines. This issue has been patched in version