Description

openssl_encrypt versions before 1.4.0 contain a critical vulnerability in pqc.py where KEM decapsulation failures silently fall back to simulation mode, generating a deterministic shared secret from only 16 bytes of the private key and publicly available encapsulated key data. Attackers who obtain 16 bytes of the private key can compute the shared secret and decrypt all ciphertext, as the fallback triggers on any KEM failure without raising an error.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-17T11:16:45.050Z",
  "pubdate": "2026-08-17T11:16:45.050Z",
  "executiveSummary": "A critical cryptographic vulnerability exists in openssl_encrypt versions before 1.4.0, specifically within the pqc.py component. The flaw involves improper error handling during Key Encapsulation Mechanism (KEM) decapsulation operations, where decryption failures silently trigger a simulation mode instead of raising an exception or halting execution. This fallback mechanism generates a deterministic shared secret derived solely from a 16-byte subset of the private key and publicly accessible encapsulated key data.\nThe business impact of this vulnerability is catastrophic for confidentiality, as successful exploitation allows malicious actors to completely bypass cryptographic protections and decrypt all associated ciphertext. The risk implication is severe, undermining the foundational security guarantees of post-cryptographic implementations within the affected package.\nAttacker capabilities include the complete recovery of shared secrets and subsequent decryption of secure communications or stored data. The primary exploitation requirement is that the adversary must obtain at least 16 bytes of the private key. Once this prerequisite is met, attackers can intentionally or opportunistically trigger KEM decapsulation failures, forcing the vulnerable software into the insecure simulation state. Given that the fallback condition executes silently without generating error logs or alerts, detection of exploitation attempts is exceptionally difficult.",
  "technicalDetails": "The vulnerability resides in the pqc.py file of openssl_encrypt versions prior to 1.4.0. The root cause of the security flaw is flawed exception handling and cryptographic fallback logic within the KEM decapsulation routine. During standard cryptographic processing, when a KEM decapsulation operation fails due to malformed ciphertext, invalid parameters, or cryptographic mismatch, the system must abort the operation and throw an error to prevent state leakage or insecure processing.\nHowever, in the vulnerable component, the implementation fails to enforce strict error handling. Instead of terminating upon a decapsulation failure, the code catches or ignores the error and defaults to a simulation mode. In this fallback state, the algorithm calculates a deterministic shared secret using a weak derivation process. Specifically, this derivation relies exclusively on a 16-byte portion of the private key combined with publicly available encapsulated key data.\nThe step-by-step attack flow proceeds as follows: First, an unauthorized adversary acquires 16 bytes of the target's private key through side-channel leakage, memory exposure, or other compromise vectors. Second, the attacker interacts with the target system or intercepts encrypted traffic, supplying or manipulating ciphertext designed to induce a KEM decapsulation failure. Third, upon processing the ciphertext, the vulnerable pqc.py component encounters the decapsulation failure and silently transitions to the deterministic simulation mode. Fourth, because the simulation mode relies on the attacker-known 16-byte private key fragment and public encapsulation data, the algorithm generates the predictable shared secret. Finally, utilizing this computed shared secret, the attacker decrypts the intercepted ciphertext, achieving full confidentiality compromise without possessing the complete, valid private key.\nThe vulnerable component operates locally or within dependent applications utilizing openssl_encrypt, affecting all unpatched versions below 1.4.0. The flaw requires no authentication or special network privileges beyond the ability to supply or influence ciphertexts processed by the vulnerable KEM decapsulation logic, provided the prerequisite 16-byte private key material has been compromised."
}