CVE-2026-81693: Memory Allocation with Excessive Size Value in jahlives openssl_encrypt

The vulnerability CVE-2026-81693 affects jahlives openssl_encrypt versions prior to 1.4.9. It involves failure to validate the 'total' field from QR JSON payloads before materializing memory ranges. Attackers can exploit this by crafting QR images with extremely large 'total' values, causing the software to allocate excessive memory without bounds. This results in denial of service due to out-of-memory conditions. The CVSS 4.0 score is 8.7, indicating high severity, with network attack vector, low complexity, no privileges or user interaction required, and high impact on availability.

Successful exploitation causes denial of service by exhausting system memory through unbounded allocation. This can disrupt availability of the affected application or system running the vulnerable openssl_encrypt function. There is no indication of code execution or data confidentiality/integrity impact.

A fix is available in jahlives openssl_encrypt version 1.4.9 and later. Users should upgrade to version 1.4.9 or above to remediate this vulnerability. Patch status is confirmed by the affectedVersions field indicating versions before 1.4.9 are vulnerable. No vendor advisory content was provided to indicate alternative mitigations or temporary fixes.