The vulnerability in jahlives openssl_encrypt before version 1.4.0 involves the use of a cryptographically weak pseudo-random number generator (PRNG) based on Python's Mersenne Twister in the generate_pseudorandom_sequence function. This PRNG is used for steganographic pixel selection. Because the Mersenne Twister is not designed for cryptographic security, an attacker with knowledge of the password can reconstruct its internal state from approximately 624 outputs. This allows the attacker to predict the pixel locations where hidden data is embedded, facilitating extraction of the concealed information.

An attacker who knows the password can recover the PRNG state and predict steganographic pixel locations, enabling extraction of hidden data. This compromises the confidentiality of data embedded using the affected versions of openssl_encrypt. There is no indication of privilege escalation, denial of service, or integrity impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 1.4.0, upgrading to version 1.4.0 or later (once available) is recommended if the vendor provides a fix. Until then, avoid using affected versions for steganographic purposes or use a cryptographically secure PRNG alternative.