openssl_encrypt versions prior to 1.4.0 rely on Python's non-cryptographic random module for selecting steganographic pixel positions through a function that generates a pseudorandom sequence. Because the random generator is a Mersenne Twister, an attacker who knows the encryption password can recover its internal state from about 624 outputs. Once the state is known, the attacker can predict every pixel location that holds hidden data and extract the payload, leading to a confidentiality breach of any information embedded through this mechanism.

The vulnerability affects the jahlives openssl_encrypt library. Any installation using openssl_encrypt version 1.3.x or earlier (i.e., any version before 1.4.0) is impacted. No specific sub-versions are listed, so all releases prior to 1.4.0 should be considered vulnerable.

The CVSS score of 8.7 reflects a high severity risk. The EPSS score is not available, but the lack of a KEV listing indicates no widely known exploitation yet. The attack requires knowledge of the password used during encryption, so it is a local or credential-based threat. If an attacker obtains the password, they can easily recover the Mersenne Twister state and predict hidden pixel positions, resulting in a direct confidentiality compromise. Mitigations should therefore focus on patching and disabling the vulnerable functionality.