CVE-2026-81692

Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.9

Description The software fails to validate the 36-bit STREAMINFO total samples field of FLAC files before using it to size a memory allocation within the np.random.randint(size=(total samples, channels)) function. A specially crafted FLAC file of approximately 50 bytes that declares roughly 100 million samples can trigger a multi-gigabyte memory allocation. This results in an out-of-memory denial of service when using the 'decrypt --stego-extract' command.

Recommendations Update to version 1.4.9 or later.