CVE-2026-74872
Received Received - Intake

Whirlpool Hash Arbitrary Code Execution in OpenSSL Encrypt

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: VulnCheck

Description
openssl_encrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirlpool hash implementation that uses broad glob patterns to load .so modules without integrity verification. Attackers can place malicious .so files matching the whirlpool*py313*.so pattern in site-packages directories to achieve native code execution when the module is loaded.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-74872
EUVD
EUVD-2026-60091

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openssl openssl_encrypt to 1.4.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-426 The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-74872 is an arbitrary code execution vulnerability in the openssl_encrypt Python package versions before 1.4.0. It affects the Whirlpool hash implementation where the code uses a broad glob pattern to load .so modules without verifying their integrity. Attackers can place malicious .so files matching the whirlpool*py313*.so pattern in site-packages directories to execute native code when the module is loaded.

Detection Guidance

Check for vulnerable openssl_encrypt versions with: pip show openssl_encrypt. Inspect site-packages directories for files matching whirlpool*py313*.so patterns. Review Python code using whirlpool hash in openssl_encrypt/modules/registry/hash_registry.py for glob pattern usage.

Impact Analysis

This vulnerability allows attackers to execute arbitrary code on your system if you are using a vulnerable version of openssl_encrypt. They can do this by placing a malicious .so file in a site-packages directory. The impact includes potential data breaches, system compromise, and unauthorized access to sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially exposing sensitive data. For GDPR, it may result in violations of data confidentiality and integrity requirements. For HIPAA, it could compromise protected health information if exploited in healthcare systems. The lack of integrity checks and permissive file loading increases risks of data breaches.

Mitigation Strategies

Upgrade openssl_encrypt to version 1.4.0 or later. Remove any untrusted .so files matching whirlpool*py313*.so patterns. Audit site-packages directories for suspicious files. Validate module loading paths and implement integrity checks for loaded modules.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74872. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart