CVE-2026-81692: openssl_encrypt before 1.4.9 Denial of Service via STREAMINFO
opensslencrypt (pip: openssl-encrypt) versions 1.4.8 and earlier fail to validate the 36-bit STREAMINFO totalsamples field of FLAC files before using it to size an allocation (np.random.randint(size=(totalsamples, channels))). A ~50-byte crafted FLAC file declaring ~100 million samples causes a multi-gigabyte memory allocation, leading to out-of-memory denial of service during 'decrypt --stego-extract'. The issue is fixed in 1.4.9; both the 1.4.x and 1.5.x lines are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openssl_encrypt (pip: openssl-encrypt)to a version that resolves this vulnerability.Fixed in 1.4.9 - Compensating control
Avoid processing/decrypting attacker-supplied FLAC files with openssl_encrypt versions 1.4.8 and earlier until upgraded to 1.4.9, as these versions do not validate the FLAC STREAMINFO 36-bit total_samples field prior to allocating memory.
Event History
Frequently Asked Questions
Which deployments are exposed to this denial of service?
Deployments using the pip package openssl-encrypt are affected if they run an affected 1.4.x or 1.5.x release. Version 1.4.8 and earlier are specifically identified as vulnerable, and 1.4.9 is identified as the fix.
What does an attacker need to trigger the issue?
An attacker needs to provide a crafted FLAC file that is processed by the decrypt --stego-extract operation. The crafted file can be roughly 50 bytes and declares an extremely large STREAMINFO total_samples value.
What is the operational impact of successful exploitation?
Processing the malicious FLAC causes openssl_encrypt to attempt a multi-gigabyte memory allocation. This can exhaust available memory and cause a denial of service.
How can I determine whether an attempted attack has reached the vulnerable code path?
Check whether decrypt --stego-extract processed untrusted FLAC input around an out-of-memory condition or unusually large memory allocation. The vulnerable allocation is sized from the FLAC STREAMINFO total_samples field.