Executive brief
openssl_encrypt is a Python library for encryption and steganography operations on audio files. Versions 1.4.8 and earlier fail to properly validate the total_samples field when parsing FLAC audio files, allowing an attacker to craft a small malicious file that causes the application to allocate multiple gigabytes of memory. This leads to out-of-memory crashes and service disruption when users attempt to decrypt or extract steganographic data.
Technical details
The vulnerability is a memory allocation flaw (CWE-789) in FLAC file parsing. The library reads the 36-bit STREAMINFO total_samples field and passes it directly to np.random.randint(size=(total_samples, channels)) without proper bounds checking. An attacker can craft a ~50-byte FLAC file declaring ~100 million samples, triggering ~800 MB initial allocation plus additional multi-gigabyte overhead from a flatten() operation and integer list. The attack is triggered during the 'decrypt --stego-extract' operation and requires no authentication. The vulnerability affects versions 1.4.8 and earlier as well as the 1.5.x line; it is fixed in version 1.4.9 by validating total_samples against the actual audio payload size.
Affected products
- openssl_encrypt openssl_encrypt 1.4.8 and earlier; 1.5.x affected, fixed in 1.4.9
Timeline
- 2026-08-27: disclosed
- 2026-08-27: patched: Version 1.4.9 released