openssl-encrypt EUVD-2026-67046

The victim must be running openssl-encrypt with the verify-usb v2 feature active against a removable drive before executing the portable install. The attacker must have had prior physical access to the specific USB drive to plant the malicious symlink and __pycache__/*.pyc file - remote exploitation is not possible. Exploitation is further limited by: (1) physical access window - the attacker must handle the drive before victim use; (2) mandatory victim interaction - the victim must run the portable install after verification completes; (3) feature-specific scope - only deployments using verify-usb on removable media are exposed; (4) package specificity - only software in the tool-tree that CPython can load as bytecode is a viable payload vehicle. The supplied CVSS vector (AV:N/PR:N/UI:N) contradicts all of these conditions and must not be used for access-control or prioritization decisions.

The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) is materially inconsistent with the vulnerability description, which describes a physical evil-maid attack requiring the attacker to handle the USB drive before the victim uses it - security teams must not rely on this vector for triage and should apply the independently assessed vector (AV:P) instead. No EPSS score was provided, and CISA KEV status is absent, indicating no confirmed active exploitation. The technical impact upon successful exploitation is severe - arbitrary code execution in the victim's user context - but real-world risk is substantially constrained by the physical access prerequisite, the requirement for victim interaction, the niche deployment footprint of this package, and the targeted nature of the evil-maid scenario. Organizations using openssl-encrypt's verify-usb feature on removable media for supply-chain or field-deployment workflows represent the meaningful risk population; all others have negligible exposure.

An attacker who briefly gains physical access to a USB drive - for example, during shipping, at an unattended workstation, or via insider access - replaces a tool-tree directory with a symlink pointing to an attacker-controlled directory tree containing the same byte-identical .py files plus a crafted __pycache__/*.pyc bytecode file. When the victim later retrieves the drive, runs verify-usb, sees PASSED, and launches the portable install, CPython silently loads the malicious .pyc in preference to the clean source, executing attacker-supplied code in the victim's user context. No public POC has been identified at time of analysis.