The vulnerability arises from a non‑standard PBKDF2 key derivation in the openssl_encrypt library versions before 1.4.0. It employs iterations=1 per call within an outer loop, resulting in a KDF with unverified security properties. Attackers can thus reduce the effort required to crack passwords protecting legacy encrypted files compared to standard PBKDF2 implementations. This weakness directly lowers the cost of offline brute‑force attacks.

Affected systems include the jahlives open-source project openssl_encrypt. Any deployments using this library with a version older than 1.4.0 are vulnerable. No specific distribution packages are listed, so the impact extends to any build that incorporates the legacy code. Users must verify their installed version and update accordingly.

The CVSS score of 8.7 indicates a high severity issue. The EPSS score is not available, and it is not currently listed in the KEV catalog. The likely attack vector is offline password cracking against encrypted files that use the legacy key derivation. Because the weakness only applies when the same key is derived repeatedly, an attacker who obtains an encrypted file can perform a targeted brute‑force attack with significantly reduced effort. Prompt patching mitigates the risk entirely.