CVE-2026-74885
LowCVSS 3.6Summary
In openssl_encrypt versions before 1.4.0, a logging bug in restore_hidden_modules() logs module counts after clearing, always showing zero restored modules and corrupting audit trails. Additionally, a race condition exists between module hiding and import hook installation, which in multi-threaded environments could allow another thread to re-import blocked modules.
Risk Assessment
Corrupted audit trails could hinder detection of unauthorized actions, and the race condition could allow loading of blocked modules, posing a threat to environment integrity.
Recommendation
It is recommended to update openssl_encrypt to version 1.4.0 or later, which includes fixes.
Original NVD description (English source)
openssl_encrypt versions before 1.4.0 contain a logging bug in restore_hidden_modules() that logs module counts after clearing, always showing zero restored modules and corrupting audit trails. Additionally, a race condition exists between module hiding and import hook installation where another thread could re-import blocked modules in multi-threaded environments.