This vulnerability affects jahlives openssl_encrypt prior to version 1.4.0. The restore_hidden_modules() function improperly outputs log data by always showing zero restored modules after clearing, which corrupts audit trails and can hinder forensic analysis. Furthermore, a race condition between module hiding and import hook installation can cause blocked modules to be re-imported by other threads in multi-threaded environments, potentially bypassing intended module restrictions. The CVSS 4.0 score is 9.3, indicating critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

The improper logging corrupts audit trails, reducing the reliability of forensic and security monitoring. The race condition may allow blocked modules to be re-imported, potentially undermining security controls in multi-threaded environments. This can lead to unauthorized code execution or bypass of module restrictions, impacting confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented at this time. Users should monitor the vendor's communications for updates and apply patches once available.