CVE-2026-74872
9.3
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Summary
openssl_encrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirlpool hash implementation that uses broad glob patterns to load .so modules without integrity verification. Attackers can place malicious .so files matching the whirlpoolpy313.so pattern in site-packages directories to achieve native code execution when the module is loaded.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| jahlives | openssl_encrypt | 0 < 1.4.0 | affected |
| jahlives | openssl_encrypt | 1.4.0 | unaffected |
Weaknesses
- CWE-426: Untrusted Search Path
References
- https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-j48q-4c78-rhf9
- https://www.vulncheck.com/advisories/openssl-encrypt-before-arbitrary-code-execution-via-whirlpool
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.