CVE-2026-74876 is a signature verification bypass in openssl_encrypt's PublicKeyBundle.from_dict() method, and the CVSS 9.8 score obscures more than it reveals. This method is explicitly documented as the interface for parsing untrusted key data — yet it performs no signature verification whatsoever. That is not a developer education problem; it's an API design failure. The function exists precisely to handle hostile input, and it ships without the security primitive its purpose demands. Every caller that passes external data to from_dict() is vulnerable by default, not because developers failed to read documentation, but because the library offers no safe path.
The EPSS of 0.00201 warrants scrutiny. A 9.8-score vulnerability with negligible exploitation probability suggests either steep prerequisites (the attack requires an API exposed to untrusted callers, which is uncommon in practice) or organic community mitigation that is inherently unstable. One blog post, one new team member, one AI code generation session — and the footgun reappears in production. The low EPSS may reflect luck as much as safety.
Audit every *_from_dict() method in this library. Signature verification bypasses cluster — if from_dict() skips this check, the institutional knowledge gap that produced it is likely systemic. The naming collision with PHP's native openssl_encrypt() function also creates tooling risk: automated scanners that can't distinguish them will generate false positives against PHP deployments while potentially missing genuine instances of this library in Python/Ruby/Go ecosystems.
Prioritize based on whether from_dict() ever receives external input in your deployment. If the library parses only internally-generated key bundles, the vulnerability is theoretical. If it accepts untrusted dictionaries from API callers or deserialization paths, treat this as exploitable and patch immediately. The fix is not developer discipline — it is either embedding verification into from_dict() or removing the method entirely from the public API.