The vulnerability lies in the portable USB drive feature of the openssl_encrypt Python package. Its integrity verification routine validates only files listed in a manifest; any additional files—such as a root‑level autorun payload—are omitted from the check, allowing the verification to succeed despite tampering. Additionally, if a drive does not provide a per‑drive salt file, a globally constant and source‑embedded KDF salt is used. This legacy salt removes precomputation resistance, enabling an attacker to perform an offline rainbow‑table attack to retrieve the drive encryption key.

The affected product is the openssl_encrypt package from the jahlives vendor, with all releases before version 1.4.9. Any application that imports this module and employs its portable USB drive capability is at risk.

The CVSS score of 9.3 marks the vulnerability as critical. Although the EPSS score is not available and the issue is not listed in CISA's KEV catalog, the high severity indicates a potentially valuable target. The likely attack vector requires physical write access to a removable drive; an attacker can insert non‑manifest files or exploit the constant‑salt weakness to precompute encryption keys offline. Once the compromised drive is processed by a system running the vulnerable code, the attacker can tamper with data integrity and potentially obtain decryption keys, undermining confidentiality and integrity of the host.