openssl-encrypt CVE-2026-81692

Exploitation requires that the target application invokes openssl-encrypt's decrypt --stego-extract subcommand against an attacker-supplied FLAC file - this is the specific code path that reads total_samples and calls np.random.randint without bounds checking. Applications that do not expose this command, that only process FLAC files from internal trusted sources, or that run stego-extract in an isolated, memory-limited subprocess are not meaningfully exposed. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication, no complexity barriers, and no user interaction requirements once the vulnerable code path is reachable. The limiting factor is whether the application exposes stego-extract processing to untrusted network input at all.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) characterises this as a network-reachable, zero-prerequisite denial-of-service with high availability impact and no confidentiality or integrity consequences. The attack requires only that the target process accepts an attacker-supplied FLAC file; no authentication, no interaction, and no special attack preparation are needed. The practical risk is strongly deployment-dependent: organisations that expose stego-extract processing to untrusted inputs (e.g., upload endpoints, automated media pipelines) face near-certain exploitability, whereas those that only process internal files have negligible exposure. No EPSS score was supplied and the CVE is not listed in CISA KEV, so exploitation probability is inferred from the CVSS vector and the trivially small crafted-file size rather than observed threat-actor activity. Given the available patch (v1.4.9) and the niche footprint of the package, this is a routine patch priority rather than a strategic threat.

An attacker crafts a ~50-byte FLAC file with the STREAMINFO total_samples field set to approximately 100 million and submits it to an application or API endpoint that calls openssl-encrypt's decrypt --stego-extract on user-supplied files. The library reads the field without validation, instructs NumPy to allocate a multi-gigabyte array, and the host process is killed by the OOM killer or becomes unresponsive. No public exploit code has been identified, but the minimal file size and straightforward construction make independent reproduction trivial for any attacker familiar with the FLAC binary format.