CVE-2026-81693
HighCVSS 7.5Summary
openssl_encrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger unbounded memory allocation and cause denial of service through out-of-memory conditions.
Risk Assessment
An attacker can cause application crash due to memory exhaustion, leading to service unavailability.
Recommendation
Upgrade openssl_encrypt to 1.4.9 or later, which validates the total field before allocation.
Original NVD description (English source)
openssl_encrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger unbounded memory allocation and cause denial of service through out-of-memory conditions.