CVE-2026-81692
Received Received - Intake

Out-of-Memory DoS in openssl-encrypt via FLAC STREAMINFO

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: VulnCheck

Description
openssl_encrypt (pip: openssl-encrypt) versions 1.4.8 and earlier fail to validate the 36-bit STREAMINFO total_samples field of FLAC files before using it to size an allocation (np.random.randint(size=(total_samples, channels))). A ~50-byte crafted FLAC file declaring ~100 million samples causes a multi-gigabyte memory allocation, leading to out-of-memory denial of service during 'decrypt --stego-extract'. The issue is fixed in 1.4.9; both the 1.4.x and 1.5.x lines are affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-08-27
AI Q&A
2026-08-27
EPSS Evaluated
N/A
NVD
CVE-2026-81692
EUVD
EUVD-2026-67048

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
openssl openssl_encrypt to 1.4.9 (exc)
openssl openssl_encrypt 1.4.*
openssl openssl_encrypt 1.5.*

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-789 The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability CVE-2026-81692 affects openssl_encrypt versions 1.4.8 and earlier. It involves improper validation of the 36-bit STREAMINFO total_samples field in FLAC files. A crafted FLAC file with a large total_samples value (e.g., 100 million) triggers an excessive memory allocation during decryption or stego-extraction, leading to an out-of-memory denial of service.

Detection Guidance

Check if openssl_encrypt versions 1.4.8 or earlier are installed using package managers like pip (pip show openssl-encrypt) or system package tools. Monitor for out-of-memory crashes during FLAC file processing, especially with large declared sample counts in STREAMINFO metadata.

Impact Analysis

This vulnerability can cause system crashes or denial of service by consuming excessive memory when processing a maliciously crafted FLAC file. It affects systems using openssl_encrypt versions 1.4.8 or earlier during decryption or stego-extraction operations.

Mitigation Strategies

Upgrade openssl_encrypt to version 1.4.9 or later immediately. Avoid processing untrusted FLAC files until patched. Implement input validation for FLAC metadata fields, particularly total_samples, to prevent excessive memory allocation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81692. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart