The vulnerability is located in PublicKeyBundle.from_dict() of openssl_encrypt, which accepts untrusted data and creates key bundles without verifying signatures. Attackers can invoke from_dict() with malicious input and then call to_identity() without any signature checks, enabling them to encrypt data using a public key chosen by the attacker. This flow can result in sensitive information being encrypted and sent to an attacker-controlled entity, effectively leaking secrets.

The affected product is openssl_encrypt from vendor jahlives. Versions prior to 1.4.0 are vulnerable. Users running any 1.x release less than 1.4.0 should consider the product impacted.

The CVSS score of 9.3 classifies this as critical, indicating a significant impact. EPSS data is not available, so the likelihood of exploitation is unknown, but the issue is not listed in the CISA KEV catalog. The likely attack vector is any component that constructs PublicKeyBundle instances from untrusted input; an attacker can supply crafted data to a vulnerable API or library call, which then facilitates secret leakage through encryption. The exploit requires only the ability to execute the vulnerable function, so it can be performed remotely if the library is exposed or locally if the application permits untrusted input.