The vulnerability arises in Microsoft vcpkg’s Windows builds of OpenSSL, where the openssldir setting is hard‑coded to a path on the build machine. This creates an uncontrolled search path element (CWE‑427) that allows an attacker to place malicious files—such as a disallowed configuration or override libraries—in that directory. If such files are loaded, an attacker could modify OpenSSL behaviour or execute arbitrary code on the affected system.

Microsoft vcpkg for Windows platforms, specifically the OpenSSL packages prior to version 3.6.1#3. The curated patch in 3.6.1#3 removes the unsafe build‑time path setting; any systems using earlier vcpkg releases are susceptible.

The CVSS base score is 7.8, indicating a high severity of potential impact. Exploitation likelihood is not quantified by EPSS and the vulnerability is not listed in the CISA KEV catalog, suggesting it is not yet known to be actively exploited. The attack vector is inferred to be local or supply‑chain, requiring the attacker to supply or modify a build machine, or to insert malicious files into the specified directory after installation. Once the vulnerable path is used, the attacker can achieve code execution or unauthorized configuration of OpenSSL, compromising confidentiality, integrity, or availability of the affected system.