by Kastro
Paper/Archive/CVE-2026-74872

CVE-2026-74872

jahlives openssl_encrypt — openssl_encrypt before 1.4.0 Arbitrary Code Execution via Whirlpool

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 52.3.523 × 2010.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

openssl_encrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirlpool hash implementation that uses broad glob patterns to load .so modules without integrity verification. Attackers can place malicious .so files matching the whirlpool*py313*.so pattern in site-packages directories to achieve native code execution when the module is loaded.

Affected

ProductAffectedFixed inSource
openssl_encrypt< 1.4.01.4.0CNA

Scores by source

VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorygithub.com/jahlives/openssl_encrypt/security/advisories/GHSA-j48q-4c78-rhf9writeupvulncheck.com/advisories/openssl-encrypt-before-arbitrary-code-execution-via-whirlpool