openssl_encrypt EUVD-2026-67064

Requires openssl_encrypt <= 1.4.8 with the plugin-signing feature in use, and specifically an operator invoking enroll_trust_key and confirming a trust anchor by a short (~32-bit) GPG key id instead of the full primary-key fingerprint; the ENFORCE signature policy must be active for the forged anchor to translate into accepted malicious plugins. The attacker must precompute a GPG key whose short key id collides under the suffix-tolerant match and must get that key in front of the operator during enrollment. Limiting factors: exploitation depends on operator interaction and a specific insecure verification habit (trusting short ids), on the attacker performing 32-bit collision/brute-force work, and on a plugin delivery path - it is not a hands-off remote attack against a default configuration despite the input vector's PR:N/UI:N.

The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H/VI:H/VA:H, score 9.3 'critical') overstates ease of exploitation relative to the description: the flaw is only triggered when an operator actively runs enroll_trust_key and confirms a short key id, which is real user interaction and non-trivial attack complexity, not the AC:L/UI:N the vector claims - verify this discrepancy against the vendor advisory. No EPSS score, no CISA KEV entry, and no public proof-of-concept were provided, so there is no evidence of active or automated exploitation; the realistic risk is a targeted supply-chain/trust attack requiring attacker collision work plus operator error rather than mass exploitation. That said, the outcome is severe (malicious code execution via trusted plugins bypassing the ENFORCE policy), so any team running openssl_encrypt with plugin signing should treat upgrading to 1.4.9 as a priority even though the practical bar is higher than the 9.3 headline suggests.

An attacker precomputes a GPG key whose short 32-bit key id collides with (or shares the matched suffix of) a key an operator intends to trust, and distributes it through the plugin/key channel. When the operator runs enroll_trust_key and confirms the short id, the attacker's colliding key is bound as a trusted anchor; the attacker then ships plugins signed by that key which pass the ENFORCE signature policy and execute in the application's context. No public exploit code was identified, but generating a 32-bit key-id collision is computationally feasible.