A flaw in openssl_encrypt versions prior to 1.4.9 allows an attacker to supply a QR JSON payload that contains an exorbitantly large total field. The library does not validate this field before allocating memory for ranges, so the allocation grows without bounds. When a program processes such a QR image, the system runs out of memory and the application becomes unresponsive, causing a denial of service. The weakness is an unbounded allocation (CWE‑789).

The vulnerability affects the jahlives openssl_encrypt library in any deployment that uses a version older than 1.4.9. Systems integrating this library into QR‑processing components are at risk unless a later version is installed.

The CVSS score of 8.7 marks the flaw as high severity. Although an EPSS score is not reported, the nature of the attack—crafting a QR image with a huge total field—suggests that exploitation is possible on any system that accepts untrusted QR inputs. The vulnerability is not listed in the CISA KEV catalog, indicating no confirmed widespread exploitation. Nonetheless, an attacker able to deliver a malicious QR image can trigger immediate service disruption through uncontrolled memory allocation.