The openssl_encrypt Python package fails to validate the 36‑bit STREAMINFO total_samples field in FLAC files before using it to size an allocation. A crafted FLAC file that declares a very large number of samples can trigger a multi‑gigabyte memory allocation during 'decrypt --stego-extract', exhausting system resources and causing an out‑of‑memory denial of service. This flaw is rated a CVSS score of 8.7, indicating a high severity impact on availability.

The vulnerability affects the openssl_encrypt package provided by jahlives. All releases up to 1.4.8, as well as the 1.4.x and 1.5.x series, are vulnerable. Users of any of these versions should verify their installed package version.

With a high CVSS score of 8.7 and no EPSS data available, the probability of exploitation is uncertain, but the impact of a successful attack would be a complete denial of service on the host executing the decryption. The attack vector is inferred to be local or any scenario where a user can supply a crafted FLAC file to the decrypt command; the vulnerability does not appear to be exploitable remotely over a network.