The vulnerability in openssl_encrypt before version 1.4.9 results from an under‑parameterized PBKDF2‑HMAC‑SHA256 implementation. Only 100,000 iterations are used to protect public‑key cryptography (PQC) private key files and 10,000 iterations for dual‑encryption file‑password verification. This weakness allows an attacker who has obtained the keyfiles or encrypted files to perform an offline brute‑force attack, rapidly testing many passwords with GPU or ASIC hardware. The impact is a loss of confidentiality for private keys and encrypted data, effectively enabling unauthorized access to the protected material.

All deployments of the jahlives:openssl_encrypt product with a release prior to 1.4.9 are affected. This includes any instance where PQC keyfile private keys or dual‑encrypted files are generated or stored with earlier releases of the library.

With a CVSS score of 8.7 the vulnerability is considered high severity. The EPSS score is not published, and the vulnerability is not listed in the CISA KEV catalog, but the lack of strong iteration counts makes offline brute‑force feasible in a practical timeframe for determined attackers. The attack requires only the possession of the keyfile or encrypted file; no network interaction is needed. Attackers can leverage modern GPU or ASIC solutions to accelerate the process, significantly reducing the wall‑clock time to recover the wrapping password.