CVE-2026-74872: openssl_encrypt before 1.4.0 Arbitrary Code Execution via Whirlpool
opensslencrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirlpool hash implementation that uses broad glob patterns to load .so modules without integrity verification. Attackers can place malicious .so files matching the whirlpoolpy313.so pattern in site-packages directories to achieve native code execution when the module is loaded.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openssl_encryptto a version that resolves this vulnerability.Fixed in 1.4.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74872?
CVE-2026-74872 has a critical severity score of 9.8.
How do I fix CVE-2026-74872?
To fix CVE-2026-74872, upgrade to OpenSSL Encrypt version 1.4.0 or later.
What type of vulnerability is CVE-2026-74872?
CVE-2026-74872 is an arbitrary code execution vulnerability.
What impact does CVE-2026-74872 have on systems?
CVE-2026-74872 allows attackers to execute arbitrary code by exploiting the Whirlpool hash implementation.
Which software is affected by CVE-2026-74872?
CVE-2026-74872 affects versions of OpenSSL Encrypt prior to 1.4.0.