CVE-2026-74874
Received Received - Intake

OpenSSL Encrypt Weak PRNG in Image Steganography

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: VulnCheck

Description
openssl_encrypt versions before 1.4.0 use Python's non-cryptographic random module for steganographic pixel selection in the generate_pseudorandom_sequence function. Attackers who know the password can recover the Mersenne Twister state from approximately 624 outputs and predict pixel locations containing hidden data for extraction.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-74874
EUVD
EUVD-2026-60093

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openssl openssl_encrypt to 1.4.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-338 The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-74874 affects openssl_encrypt versions before 1.4.0. It uses Python's non-cryptographic random module for steganographic pixel selection. The generate_pseudorandom_sequence function relies on the Mersenne Twister PRNG, which can be predicted from approximately 624 outputs. Attackers knowing the password can recover the PRNG state and identify pixels containing hidden data to extract it.

Detection Guidance

Check if openssl_encrypt versions before 1.4.0 are installed by running: pip show openssl_encrypt. If the version is less than 1.4.0, the system is vulnerable. Inspect the code for use of Python's random module in steganography functions like generate_pseudorandom_sequence().

Look for plaintext password storage in steganography modules and verify if only the first 8 bytes of SHA-256 hash are used as a seed.

Impact Analysis

If you use openssl_encrypt versions before 1.4.0, attackers could extract hidden data from steganographic images if they know or guess the password. This could lead to unauthorized access to sensitive information embedded in images, compromising confidentiality and integrity of concealed data.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's confidentiality requirements and HIPAA's safeguards for protected health information. Organizations may face compliance violations, legal penalties, and reputational damage if sensitive data is compromised through this flaw.

Mitigation Strategies

Upgrade openssl_encrypt to version 1.4.0 or later. Replace the insecure PRNG with a cryptographically secure method like HMAC-DRBG or Python's secrets module. Use the full 32-byte SHA-256 output as seed material.

Store passwords in SecureBytes instead of plain strings. Review and update all steganography modules to use secure pixel selection methods like Fisher-Yates shuffle with numpy Generator.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74874. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart