CVE-2026-74872

CriticalCVSS 9.8

Published: 17/08/2026(UTC)Translated: 17/08/2026(UTC)NVD NIST

Summary

openssl_encrypt before version 1.4.0 contain an arbitrary code execution vulnerability in the Whirlpool hash implementation that uses broad glob patterns to load .so modules without integrity verification. Attackers can place malicious .so files matching the whirlpool*py313*.so pattern in site-packages directories to achieve native code execution when the module is loaded.

Risk Assessment

The risk is that remote code execution can occur in the application context, potentially leading to full system compromise or data theft.

Recommendation

It is recommended to immediately upgrade openssl_encrypt to version 1.4.0 or later, which verifies the integrity of loaded modules.

Original NVD description (English source)

openssl_encrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirlpool hash implementation that uses broad glob patterns to load .so modules without integrity verification. Attackers can place malicious .so files matching the whirlpool*py313*.so pattern in site-packages directories to achieve native code execution when the module is loaded.