The vulnerability lies in the PKCS#7 EnvelopedData decryption routine of the cryptography library, where decrypting a RecipientInfo's encryptedKey can produce distinct error messages and timing differences that reveal the exact length restored from the RSA operation. This behavior allows an attacker to construct a Bleichenbacher oracle, enabling decryption of the wrapped encryption key when the ciphertext is supplied to the vulnerable application. The weakness is an information disclosure that can be leveraged to recover the sought content‑encryption key, potentially exposing all data protected by that key.

The issue affects the pyca:cryptography library in versions 44.0.0 through 49.x.x, inclusive. Applications that depend on these releases and resort to raw cryptography.pkcs7_decrypt_der, pkcs7_decrypt_pem, or pkcs7_decrypt_smime functions are vulnerable if they process user‑supplied EnvelopedData. Critical exposure occurs if the linked OpenSSL, LibreSSL, or BoringSSL dispatches do not reject invalid padding implicitly, which is the case in OpenSSL 3.0, 3.1, LibreSSL, and BoringSSL.

The CVSS score of 8.2 indicates a high severity exploitation scenario. An attacker requires a service that automatically decrypts untrusted S/MIME or PDF envelopes that match the victim’s certificate and can respond in real time to distinguishable failures. With no current EPSS data or KEV listing, adoption of the fix is still critical for any production environment processing potentially malicious enveloped messages, as the exploit is realistically feasible against such services.