Description

openssl_encrypt before 1.4.9 fails to validate the memory_cost parameter from identity file protection blocks, allowing attackers to trigger out-of-memory conditions during key derivation. Attackers with write access to local identity stores can craft malicious identity files with excessive memory_cost values that cause the host to crash when unlocking identities before authentication.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.2",
  "pubDate": "2026-08-27T17:21:02.477Z",
  "pubdate": "2026-08-27T17:21:02.477Z",
  "executiveSummary": "The vulnerability residing in openssl_encrypt versions prior to 1.4.9 involves a critical failure in input validation regarding the memory_cost parameter found within identity file protection blocks. This flaw allows an attacker with localized write access to manipulate identity files, specifically by injecting excessively high memory_cost values during the key derivation process.\nThe primary impact of this vulnerability is an unauthenticated Denial of Service (DoS) resulting from an out-of-memory (OOM) condition on the host machine. By forcing the application to allocate massive amounts of system memory during the decryption or unlocking phase, the attacker can trigger a host crash. This security defect necessitates that the attacker already possesses write access to local identity stores, limiting the scope of the exploit to environments where an attacker can modify identity configurations. Given the potential for system-wide instability, the risk is significant for services relying on these files for automated identity management or authentication processes.",
  "technicalDetails": "The vulnerability is fundamentally rooted in a lack of bounds checking on the memory_cost parameter provided within identity file protection blocks. During the key derivation function (KDF) initialization, the openssl_encrypt utility fails to sanitize or validate the user-supplied memory_cost input against system resource constraints. Consequently, the software interprets this parameter as a legitimate request for memory allocation.\nWhen an attacker crafts a malicious identity file with an intentionally exorbitant memory_cost value, the victim application attempts to allocate the requested buffer size to satisfy the KDF parameters. If the requested allocation exceeds available physical or virtual memory, the operating system's memory management subsystem may trigger an OOM killer or cause an immediate process collapse due to memory exhaustion.\nThe attack flow begins when an attacker gains write access to the filesystem where identity files are stored. By modifying the target identity file's protection header, the attacker inserts a crafted memory_cost value designed to exhaust host resources upon the next invocation of the unlocking function. When the software attempts to decrypt or initialize the identity, it reads the malicious parameter and commits to an expensive memory allocation cycle. This behavior occurs during the key derivation phase, before any actual authentication or validation logic is executed, effectively bypassing standard authorization checkpoints.\nBecause the vulnerability is triggered during the identity file processing phase, the exploit does not require the attacker to possess valid credentials for the identity store, only the capability to modify the store files. The vulnerable component is the identity file parsing and KDF initialization module within openssl_encrypt versions prior to 1.4.9. The impact is a total system crash or service disruption, which can be repeatedly triggered if the identity file remains in its compromised state. The lack of prior authentication makes this a potent vector for local Denial of Service attacks."
}