CVE-2026-74900 affects jahlives openssl_encrypt versions prior to 1.4.0. The vulnerability arises from unchecked error conditions in the post-quantum cryptography module pqc.py. When a KEM decapsulation failure occurs, the code silently falls back to a simulation mode that deterministically generates the shared secret from only 16 bytes of the private key combined with publicly available encapsulated key data. This behavior allows attackers who can obtain these 16 bytes of the private key to derive the shared secret and decrypt all ciphertext without triggering an error or alert.

The vulnerability allows attackers with access to a small portion (16 bytes) of the private key to compute the shared secret and decrypt all ciphertext encrypted using the affected versions of openssl_encrypt. This compromises the confidentiality of encrypted communications and data protected by this library. The issue is critical due to the ease of exploitation (no privileges or user interaction required) and the high impact on confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented at this time. Users should monitor the vendor's communications for updates and apply patches once available. Until then, consider restricting access to private key material to prevent attackers from obtaining the 16 bytes required for exploitation.