CVE-2026-74874

EUVD-2026-60093
openssl_encrypt versions before 1.4.0 use Python's non-cryptographic random module for steganographic pixel selection in the generate_pseudorandom_sequence function. Attackers who know the password can recover the Mersenne Twister state from approximately 624 outputs and predict pixel locations containing hidden data for extraction.
PRNG
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 35.65%
Affected Products (NVD)
VendorProductVersion
jahlivesopenssl_encrypt
𝑥
< 1.4.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-vfgx-5q85-58q3
https://www.vulncheck.com/advisories/openssl-encrypt-before-weak-prng-steganography-pixel-selection