Weak Random Number Generation in OpenSSL Encryption Plugin by OpenSSL

CVE-2026-74874

What is CVE-2026-74874?

The vulnerability in OpenSSL's encryption plugin arises from the use of Python's non-cryptographic random module for selecting steganographic pixels. In versions prior to 1.4.0, this implementation allows attackers, who possess knowledge of the encryption password, to recover the internal state of the Mersenne Twister from approximately 624 outputs. This can enable an attacker to predict and extract pixel locations where hidden data is stored, posing a significant risk to data integrity and confidentiality.

References