openSSL_encrypt before 1.4.9 fails to prevent namespace collisions between a user’s own identities and contact entries in the IdentityStore, allowing an attacker to create a shadowed contact that is hidden until the corresponding own identity is removed. When that identity is deleted, the shadowed contact becomes visible and resolves to the attacker’s keys, enabling the attacker to silently substitute encryption keys for files encrypted by the application.

The vulnerability is present in all releases of the openssl_encrypt library distributed by vendor jahlives. No specific version numbers are provided in the description, so any release prior to a future fix is considered affected.

The CVSS score of 9.3 indicates a very high severity vulnerability. The EPSS score is not available, and the issue is not listed in CISA’s KEV catalog, suggesting that publicly known exploits are currently absent. Exploitation requires the ability to create or modify entries in the IdentityStore, which implies authenticated privileged access or an insider threat. The likely attack vector is an account that can write to the identity store, as no externally exposed network interface is described.