The vulnerability in openssl_encrypt allows an attacker who can create a malicious encrypted file to declare arbitrarily large Argon2, scrypt, or balloon KDF parameters in the file metadata or keystore header. Because the software does not validate these cost values, processing such a file triggers an unchecked allocation of memory that can grow without bound, exhausting system resources and causing the process to crash. This denial of service effect occurs without requiring authentication and can affect any instance that reads such files. This vulnerability qualifies as an Unbounded Resource Consumption problem (CWE‑400).

All installations of the jahlives:openssl_encrypt library with versions prior to 1.4.9 are affected. The vulnerability exists in all releases before the 1.4.9 update, regardless of platform or deployment topology.

The CVSS score of 8.7 indicates a high severity denial of service risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, implying that no publicly known exploitation has been reported at this time. The likely attack vector is the delivery of a crafted encrypted file to an application or user that processes such files, with the opportunity for local or remote exploitation depending on how the file is introduced into the system. Because the flaw does not require privileged access or successful authentication, it can be exploited by an attacker who can get the vulnerable process to open the file, leading to memory exhaustion and service disruption.