AIKIDO-2026-774596

TL;DR

DuckDB's block-based filesystem encryption contains several cryptographic weaknesses. It can fall back to a non-cryptographic pcg32 random number generator to derive keys and IVs, clears key material with a memset call the compiler may remove, and does not verify the return value of OpenSSL rand_bytes. The database header selects the cipher, so the mode can also be downgraded from GCM to CTR to bypass integrity checks. The fix stops using the insecure fallback RNG, zeroes memory with a secure primitive, checks the RNG return code, and requires explicit opt-in for integrity-free ciphers.