CVE-2026-9265
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
Crypt::OpenSSL::PKCS12 versions before 1.96 for Perl allow a heap OOB read in print_attribute for UTF8STRING attributes. The print_attribute() function copies an ASN.1 attribute value into a memory buffer without adding a NUL terminator, leading to unsafe reads of adjacent bytes.
Risk Assessment
An attacker could exploit this vulnerability to read memory data, potentially leading to the disclosure of sensitive information or unauthorized code execution.
Recommendation
It is recommended to upgrade to Crypt::OpenSSL::PKCS12 version 1.96 or later to mitigate this vulnerability.
Other vulnerabilities in Crypt::OpenSSL::PKCS12
See all- CVE-2026-8721Critical
Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl truncates passwords with embedded NULLs. Password parameters in PKCS12.xs are declared char *, which leads to the loss of password length in Perl.
- CVE-2026-8507Critical
Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl have out-of-bounds (OOB) write flaws. When parsing a PKCS12 file with a >= 1 GiB OCTET STRING (or BIT STRING) attribute, a heap out-of-bounds write could be triggered, leading to remote-code-execution potential (RCE) due to a signed integer overflow in the size calculation passed to Renew().
- CVE-2026-17510High
In the Crypt::OpenSSL::PKCS12 library for Perl before version 1.98, there is a NULL pointer dereference vulnerability in the print_attribute function when handling a zero-length BMPSTRING attribute. The zero length causes the buffer to be freed and return NULL, and a subsequent strlen call on that pointer crashes the process.
Original NVD description (English source)
Crypt::OpenSSL::PKCS12 versions before 1.96 for Perl permits a heap OOB read in print_attribute UTF8STRING path. print_attribute() copies a UTF8STRING ASN.1 attribute value into a heap buffer sized exactly to its declared length via strncpy, leaving no NUL terminator. Downstream callers run strlen() on the result and pass the inflated length to newSVpvn(), copying attacker-influenced adjacent heap bytes into a Perl scalar.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS