The vulnerability lies in a GPG signature verification routine in openssl_encrypt that only checks for a valid signature status without checking for revoked or expired keys or GPG exit codes, allowing attackers with previously revoked or expired signing keys to bypass the check and inject malicious plugins into the host process. This can lead to the execution of arbitrary code within the application context.

The flaw affects the openssl_encrypt package provided by jahlives. Versions prior to 1.4.9 are vulnerable; users should verify their installed version and upgrade if it falls below 1.4.9.

The CVSS score of 9.3 indicates critical severity and the lack of KEV listing does not diminish the risk. Since the exploit requires only knowledge of a compromised but now revoked or expired key, the attack vector is local to the application’s plugin infrastructure, meaning attackers can leverage user‑provided keys to execute malicious code on the target host. The EPSS score is not available, so the current exploitation probability is unknown, but the high CVSS score suggests a potentially significant threat.