CVE-2026-74900 describes a critical vulnerability in the jahlives openssl_encrypt library prior to version 1.4.0. The vulnerability arises from unchecked error conditions in the pqc.py module during KEM decapsulation. When decapsulation fails, the code falls back silently to a simulation mode that generates a deterministic shared secret using only 16 bytes of the private key combined with publicly available encapsulated key data. This fallback does not raise an error, enabling attackers who have access to 16 bytes of the private key to derive the shared secret and decrypt all ciphertext encrypted with the affected library.

The vulnerability allows attackers with access to a small portion (16 bytes) of the private key to compute the shared secret deterministically and decrypt all ciphertexts encrypted using the vulnerable openssl_encrypt versions. This compromises the confidentiality of all encrypted communications relying on this library. The CVSS 4.0 score of 9.3 reflects a critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch link is provided at this time. Users should monitor the vendor's announcements for updates and avoid using versions prior to 1.4.0 if possible until a fix is available.