CVE-2026-74873 affects jahlives openssl_encrypt versions prior to 1.4.0. The vulnerability arises because passwords provided through the --password command-line argument are visible in process listings accessible to all system users. This exposure allows attackers with local access to retrieve plaintext passwords and keystore passwords by examining process arguments, compromising confidentiality.

The vulnerability allows local attackers to obtain plaintext passwords and keystore passwords by viewing process arguments. This can lead to unauthorized access to encrypted data or systems relying on these credentials. The CVSS 4.0 score of 8.7 reflects a high severity due to the ease of exploitation and the sensitive nature of the exposed information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid passing sensitive passwords via command-line arguments. Use alternative secure methods for providing passwords, such as environment variables or protected configuration files, to prevent exposure in process listings.