CVE-2026-74874
HighCVSS 7.5Summary
openssl_encrypt before version 1.4.0 use Python's non-cryptographic random module for steganographic pixel selection in the generate_pseudorandom_sequence function. Attackers who know the password can recover the Mersenne Twister state from approximately 624 outputs and predict pixel locations containing hidden data for extraction.
Risk Assessment
The risk includes the possibility of an attacker recovering hidden data, compromising the confidentiality of steganographically encrypted information.
Recommendation
It is recommended to upgrade openssl_encrypt to version 1.4.0 or later, which uses a cryptographically secure random number generator.
Original NVD description (English source)
openssl_encrypt versions before 1.4.0 use Python's non-cryptographic random module for steganographic pixel selection in the generate_pseudorandom_sequence function. Attackers who know the password can recover the Mersenne Twister state from approximately 624 outputs and predict pixel locations containing hidden data for extraction.