The vulnerability lies in the fact that openssl_encrypt versions prior to 1.4.9 print a user‑controlled key_id directly to standard error without escaping control characters. Attackers can embed terminal escape sequences into the key_id field of an encrypted message, causing the tool to repaint or modify the terminal output during decryption auto‑detection. The injected code can also fabricate authenticity verification blocks, effectively forging proof of ownership or integrity. This results in a severe loss of trust in the data, allowing an attacker to masquerade as legitimate content or to alter output display without detection.

The affected product is jahlives’ openssl_encrypt. All releases before version 1.4.9 are vulnerable; the fix is incorporated in version 1.4.9 and later. No other vendor or product variants are listed.

The CVSS score of 9.3 highlights the high severity, and while EPSS data is not available, the absence from the CISA KEV catalog does not mitigate the risk. The likely attack vector involves an attacker delivering a crafted encrypted file to a user who runs openssl_encrypt in an interactive terminal session. When the tool attempts to automatically detect decryption parameters, the unsanitized key_id is echoed, executing the injected escape sequences and forging authenticity checks. This local‑interaction scenario can be abused in shared or administrative environments and therefore represents a high likelihood of exploitation if the vulnerability is not addressed.