CVE-2026-74876
CriticalCVSS 9.8Summary
openssl_encrypt before version 1.4.0 contains a vulnerability in PublicKeyBundle.from_dict() that creates key bundles from untrusted data without verifying signatures. Attackers can call from_dict() followed by to_identity() without signature verification to encrypt data using attacker-controlled public keys, leaking secrets.
Risk Assessment
The risk is that confidential data can be intercepted by encrypting it with an attacker-controlled public key, allowing the attacker to read it after decryption.
Recommendation
It is recommended to upgrade openssl_encrypt to version 1.4.0 or later, which verifies signatures when creating key bundles.
Original NVD description (English source)
openssl_encrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.from_dict() that creates key bundles from untrusted data without verifying signatures. Attackers can call from_dict() followed by to_identity() without signature verification to encrypt data using attacker-controlled public keys, leaking secrets.