CVE-2026-74874: openssl_encrypt before 1.4.0 Weak PRNG Steganography Pixel Selection
opensslencrypt versions before 1.4.0 use Python's non-cryptographic random module for steganographic pixel selection in the generatepseudorandomsequence function. Attackers who know the password can recover the Mersenne Twister state from approximately 624 outputs and predict pixel locations containing hidden data for extraction.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openssl_encryptto a version that resolves this vulnerability.Fixed in 1.4.0 - Compensating control
Ensure attackers do not have access to the password/secret used by openssl_encrypt; otherwise they can recover the Mersenne Twister state from ~624 outputs and predict pixel locations for hidden data extraction.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74874?
The severity of CVE-2026-74874 is rated high with a CVSS score of 7.5.
How do I fix CVE-2026-74874?
To fix CVE-2026-74874, upgrade to OpenSSL Encrypt version 1.4.0 or later.
What vulnerabilities does CVE-2026-74874 exploit?
CVE-2026-74874 exploits weak pseudorandom number generation during steganographic pixel selection.
Who is affected by CVE-2026-74874?
Users of OpenSSL Encrypt versions prior to 1.4.0 are affected by CVE-2026-74874.
What kind of attack can be executed using CVE-2026-74874?
Attackers can recover pixel locations by predicting the Mersenne Twister state using known passwords.