CVE-2026-74872CWE-426

CVE-2026-74872

Critical · published August 17, 2026

CVSS v3.1

9.8

EPSS

Percentile

51.8

In the wild

Unconfirmed

What it is

openssl_encrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirlpool hash implementation that uses broad glob patterns to load .so modules without integrity verification. Attackers can place malicious .so files matching the whirlpool*py313*.so pattern in site-packages directories to achieve native code execution when the module is loaded.

The record

Technical detail

CVSS v3.1: 9.8 · CRITICAL
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: 9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS: 0.00679 · 51.8th percentile
Weakness: CWE-426 · Untrusted Search Path
Published: 2026-08-17T15:16Z

Affected products (1)

Product	Versions	Fixed in
jahlives/openssl_encrypt	< 1.4.0	1.4.0

References (2)

https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-j48q-4c78-rhf9 · [email protected]https://www.vulncheck.com/advisories/openssl-encrypt-before-arbitrary-code-execution-via-whirlpool · [email protected]

EPSS history

Timeline

17 AUG 11:04Z
openssl_encrypt before 1.4.0 Arbitrary Code Execution via Whirlpool
cvelistv5