openssl_encrypt EUVD-2026-67070

Exploitation requires write access to the local identity store directory or files used by the openssl_encrypt library - this is the specific, concrete prerequisite stated in the CVE description. The vulnerability is triggered during the identity-unlocking phase, which occurs before authentication, meaning no authenticated session to the target application is needed to trigger the crash once the malicious file is in place. Exploitation is limited to: (1) local access to the host, ruling out remote unauthenticated attackers; (2) write permission to the identity store path, which may or may not require elevated OS-level privileges depending on the deployment's filesystem ACLs; and (3) systems running openssl_encrypt versions prior to 1.4.9. The CVSS 4.0 vector's PR:N conflicts with the write-access requirement described - defenders should verify with the vendor whether the identity store is world-writable by default, as that would materially change the privilege bar.

Real-world risk is moderate and constrained by the local attack vector. The CVSS 4.0 base score of 6.9 reflects high availability impact (VA:H) on the vulnerable system but no confidentiality or integrity loss. The attack vector is local (AV:L), meaning an attacker must already have write access to the identity store on the affected host - this is a meaningful prerequisite that limits exposure compared to network-exploitable denial-of-service flaws. No public exploit code has been identified and this CVE is absent from the CISA KEV catalog, keeping the exploitation probability low. EPSS data was not provided in the source intelligence. The discrepancy between the CVSS 4.0 vector's PR:N and the description's explicit requirement for write access to local identity stores warrants clarification with the vendor - if write access genuinely requires elevated privilege, the PR metric should be PR:L, lowering the effective score. The product's niche deployment footprint further reduces aggregate exposure. The primary risk population is systems where untrusted local users can write to the identity store directory.

A local attacker with write access to the identity store directory places a crafted identity file containing an extreme memory_cost value (for example, several terabytes) in the Argon2 configuration block. When a legitimate user or service attempts to unlock identities, the library reads the malicious file and passes the unchecked memory_cost to Argon2 key derivation, causing the host to exhaust available RAM and crash before authentication completes. No public exploit code has been identified at time of analysis, but the attack is mechanically straightforward for any local user with write access to the identity store.