The flaw in openssl_encrypt is caused by inadequate sanitization of recovery‑slot metadata. Attackers can embed control characters, bidirectional overrides, and line separators into the metadata of a crafted encrypted file. When the desktop GUI processes this file during an irreversible removal operation, the injected characters cause the confirmation dialog to display forged warning text. This UI injection flaw, catalogued as CWE‑116, enables an attacker to manipulate the user’s view of the removal operation and potentially trick a user into confirming the deletion of important data, resulting in loss of files without needing to gain code execution privileges.

All releases of the openssl_encrypt desktop application before version 1.4.9 are affected, regardless of operating system. A client using any 1.4.8 or earlier release may be exposed to this vulnerability if it processes recovery‑slot data created by an attacker.

The CVSS score of 9.3 categorizes this vulnerability as Critical, and though EPSS data is not available and it is not listed in the CISA KEV catalog, the flaw’s exploitation is primarily through social engineering. An attacker can craft a malicious encrypted file and deliver it to a target user, who when opening the file triggers the faulty confirmation dialog that displays forged text. Because the attack relies on user interaction with a malformed file, it is feasible for an attacker with little technical skill to exploit the weakness, elevating the overall risk.