CVE-2026-81693
Received Received - Intake

OpenSSL Memory Allocation Flaw in QR JSON Parsing

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: VulnCheck

Description
openssl_encrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger unbounded memory allocation and cause denial of service through out-of-memory conditions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-08-27
AI Q&A
2026-08-27
EPSS Evaluated
N/A
NVD
CVE-2026-81693
EUVD
EUVD-2026-67049

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-789 The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the openssl-encrypt package versions before 1.4.9. It involves improper validation of the total field in QR JSON payloads. Attackers can craft QR codes with extremely large total values, causing unbounded memory allocation and leading to denial of service through out-of-memory conditions.

Detection Guidance

Check if your system uses openssl-encrypt versions <= 1.4.8 by running: openssl-encrypt --version. Inspect QR processing functions for large total field values in JSON payloads. Monitor for out-of-memory errors or system hangs during QR processing.

Impact Analysis

This vulnerability can cause system hangs or crashes due to excessive memory consumption. If exploited, it may lead to denial of service, making systems unresponsive or unavailable. Systems processing untrusted QR codes are particularly at risk.

Mitigation Strategies

Upgrade openssl-encrypt to version 1.4.9 or later immediately. Validate all QR JSON payloads to ensure total and part fields are within 1-99 range. Implement input validation for QR data before processing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81693. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart