High severity7.5NVD Advisory· Published Aug 17, 2026· Updated Aug 17, 2026

CVE-2026-74888

Description

openssl_encrypt versions before 1.4.0 use a non-standard PBKDF2 key derivation construction with iterations=1 per call in an outer loop, creating a KDF whose security properties have not been formally analyzed. Attackers can exploit this weakened key derivation to more efficiently crack passwords protecting legacy encrypted files compared to standard PBKDF2 implementations.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Jahlives/openssl_encryptllm-fuzzy
Range: <1.4.0

Patches

Vulnerability mechanics

References

github.com/jahlives/openssl_encrypt/security/advisories/GHSA-743f-89fg-x288nvd
www.vulncheck.com/advisories/openssl-encrypt-before-non-standard-pbkdf2-key-derivationnvd

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000