The vulnerability exists in openssl_encrypt implementations before version 1.4.0, where the Whirlpool hash module employs universal glob patterns to load shared object files without verifying their integrity. When an attacker supplies a malicious .so file that matches the pattern whirlpool*py313*.so into a site‑packages directory, the loader imports it into the running process, allowing the execution of native machine code. This flaw is categorized as CWE-426, representing an insecure design that permits uncontrolled use of third‑party modules.

The affected product is the openssl_encrypt library, version 1.4.0 and earlier. The flaw is relevant for deployments that use the Python bindings for this library and have site‑packages directories writable by an attacker. No other vendors or product variants are listed; the issue is confined to this library version range.

The CVSS score of 9.3 classifies this exploit as critical. The EPSS score is not available, so the exact probability of exploitation is uncertain, but the lack of integrity checks means that if an attacker can place files in a site‑packages path, successful exploitation is highly likely. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by writing a malicious shared object into a site‑packages directory that the Whirlpool module scans and then triggering a call to openssl_encrypt to make the loader import the injected module.