Is CVE-2026-74875 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-74875?

CVE-2026-74875 has a CVSS v3 severity of CRITICAL (9.8).

Back

CVE-2026-74875

Description

openssl_encrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be accepted. Attackers can remove the jsonschema package or supply unknown metadata format versions to bypass all schema checks and process malicious data.