The vulnerability in openssl_encrypt prior to 1.4.9 allows an attacker to replace legitimate public keys in an identity store with malicious ones while preserving the declared fingerprint. Because the library does not re-derive or validate fingerprints when loading identities from identity.json, encrypted data can be sent to the attacker’s key and signatures can be forged to appear authentic. This undermines both confidentiality and integrity of encrypted communications.

The affected product is the openssl_encrypt library from the jahlives project. All versions earlier than 1.4.9 are impacted. No other vendors or product versions are listed.

The CVSS score of 9.3 indicates a critical severity. Although an EPSS score is unavailable, the lack of KEV listing suggests no widespread exploitation yet. Attackers must gain the ability to modify the identity.json file or otherwise inject a rogue key into the identity store. The likely attack vector is local or privileged access that permits file system changes, though an attacker with such access could remain undetected because fingerprint checks do not detect the substitution.