openssl_encrypt EUVD-2026-67042

Exploitation requires two conditions: (1) the target host must be running openssl_encrypt version 1.4.x before 1.4.9 with the optional D-Bus crypto service installed and running - this service is not present in 1.5.x and its presence in 1.4.x depends on whether the optional component was deployed; and (2) the attacker must possess a local OS user account with access to the D-Bus system bus, which is the default for all local users on Linux systems using systemd/D-Bus. No elevated privileges, no specific group membership, and no special configuration of the attacker's account are required beyond being a logged-in local user. Remote exploitation is not possible without a prior local foothold, as the D-Bus system bus is not exposed over the network. The optional nature of the D-Bus service is the single most important limiting factor: environments that have not installed or enabled it have no exposure regardless of openssl_encrypt version.

The CVSS 4.0 base score of 6.9 (AV:L/AC:L/AT:N/PR:N/UI:N/VA:H) accurately reflects a locally exploitable, low-complexity, high-availability-impact denial-of-service. The local attack vector (AV:L) is the primary risk limiter: the D-Bus system bus is not reachable from the network without a prior foothold, so the realistic threat actor is an insider or a process already running on the host. There is no KEV listing and no EPSS data was provided, and no POC was referenced in the available intelligence, all of which suggest this is not under active or widespread exploitation. The persistence of the impact - the daemon's concurrency gate remains broken across subsequent calls until the property is corrected or the daemon restarted - elevates this beyond a transient nuisance. The narrow applicability (optional D-Bus service, 1.4.x only) further constrains the exposed population. No conflicts between the CVSS vector and the description were identified; both consistently indicate local, low-complexity, no-additional-privilege access as the sole requirement. This is a moderate-priority issue for any operator confirmed to be running the affected version with the optional service active.

A local user with a standard shell account on a host running openssl_encrypt 1.4.x with the D-Bus service active uses dbus-send or gdbus to invoke org.freedesktop.DBus.Properties.Set, passing MaxConcurrentOperations as the property name and -1 or 0 as the value, requiring no elevated privileges or special tooling. The daemon's concurrency gate immediately begins refusing all subsequent cryptographic requests, producing a persistent service outage for any caller relying on the daemon until it is restarted. No public exploit code has been identified at time of analysis, but the attack is reproducible with standard D-Bus utilities available on any Linux desktop or server.