CRITICALVulnerability

CVE-2026-74876

openssl_encrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.from_dict() that creates key bundles from untrusted data without verifying signatures. Attackers can call from_dict() followed by to_identity() without signature verification to encrypt data using attacker-controlled public keys, leaking secrets.

Properties

severity
CRITICAL
score
9.8
epss_score
0.00201
cve_id
CVE-2026-74876
vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
published_at
2026-08-17T11:16:42.073
last_modified
2026-09-01T15:28:46.997
epss_percentile
0.1003

Related Entities (4)

ENRICHED_BY (1)

[Source]FIRST EPSS

AFFECTS_PRODUCT (1)

[Product]

HAS_WEAKNESS (1)

[Weakness]Improper Verification of Cryptographic Signature

DESCRIBED_BY (1)

[Source]NVD

Explore deeper with Ninja Signal's threat intelligence graph

CVE-2026-74876 — Ninja Signal Threat Intelligence | Ninja Signal