The vulnerability is a failure to validate the memory_cost parameter used during Argon2 key derivation in the openssl_encrypt library. An attacker can supply a malicious identity file with an excessively large memory_cost value, causing the key derivation process to allocate a large amount of memory. The excessive allocation leads to an out‑of‑memory condition that crashes the host during identity unlock attempts, resulting in a denial of service. This weakness maps to CWE‑400.

The issue affects the openssl_encrypt package from jahlives, specifically any build version prior to 1.4.9. Identity files stored locally and processed by this library are the vector for exploitation; the vulnerability is present whenever a user has the ability to write to the identity store used by the application.

The CVSS score of 6.9 indicates a moderate severity, and the exploitability depends on the attacker having write access to the local identity store. Attackers with that privilege can craft files with large memory_cost values, trigger an OOM crash, and disrupt service availability. Although the EPSS score is not currently available and the vulnerability is not listed in the CISA KEV catalog, the potential for local denial of service makes prompt remediation advisable.