openssl_encrypt EUVD-2026-67049

No special conditions are required beyond the ability to submit a QR image to an application using the affected openssl_encrypt library (before version 1.4.9). Exploitation is limited by the following factors: (1) the target application must use openssl_encrypt specifically for QR code processing - applications using the library only for encryption without QR ingestion are not affected; (2) the crafted QR must be accepted by the application's QR parsing code path before being passed to the vulnerable validation logic; (3) host-level memory limits (PHP memory_limit, OS ulimits, container cgroup constraints) may prevent full memory exhaustion and instead cause a recoverable process-level crash rather than host-wide OOM. No authentication, specific configuration, or non-default deployment mode is required - the vulnerability is reachable against any default deployment that processes QR input.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) accurately reflects the low friction of exploitation: no authentication, no special conditions, and no user interaction are required. The impact is limited strictly to availability - confidentiality and integrity are unaffected (VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) - which limits the blast radius compared to code-execution flaws of similar CVSS score. EPSS data was not provided in the input; given the trivial attack conditions but niche product footprint, real-world exploitation risk is likely low in absolute terms. No CISA KEV listing exists and no POC has been identified, further supporting a lower operational priority in most environments. The primary real-world risk is concentrated in applications that expose QR ingestion endpoints publicly, such as event ticketing or logistics platforms. SSVC signals: exploitation status unconfirmed, attack is automatable (AV:N/AC:L/PR:N), technical impact is partial (DoS only, no code execution).

An attacker targeting an internet-facing ticketing or logistics application that uses openssl_encrypt to validate QR codes submits a crafted QR image in which the embedded JSON payload contains an astronomically large 'total' value (e.g., 2^63). The library reads this value and attempts to allocate a corresponding memory range without validation, causing the PHP worker or host process to exhaust available RAM, crashing the service or triggering OOM-killer termination across co-hosted services. No public exploit code has been identified, but the attack requires only the ability to craft a QR image, which is trivially achievable with standard libraries.