Description
Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in print_attribute via a zero length BMPSTRING attribute.

print_attribute() sizes the destination buffer for a BMPSTRING attribute from its declared byte length with `Renew(*attribute, length, char)`. A zero length attribute makes that a zero size reallocation, which Perl implements as a free returning NULL, so the buffer pointer becomes NULL, the following `strncpy` copies nothing, and the caller dereferences NULL in the `strlen()` it passes to `newSVpvn()`. A zero length BMPSTRING is even length, so the ASN.1 decoder accepts it and the value reaches this code. The UTF8STRING, OCTET STRING and BIT STRING arms size on `length + 1` or `length * 4 + 1` and are unaffected.

Any caller that passes an untrusted PKCS#12 file to info_as_hash() can crash the process. info() prints attribute values directly without sizing a buffer and is unaffected.
Published: 2026-08-09
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability arises when Crypt::OpenSSL::PKCS12 processes a PKCS#12 file containing a BMPSTRING attribute of zero length. The library allocates a buffer of size zero, deallocates it, and leaves a NULL pointer. Subsequent string operations dereference this pointer, causing an immediate process crash via a null pointer dereference. The crash occurs within print_attribute, invoked by info_as_hash(). No code execution is afforded by this scenario; the effect is limited to instability and a denial of service.

Affected Systems

Products affected are Perl modules Crypt::OpenSSL::PKCS12 with versions earlier than 1.98, maintained by JONASBN. Any installation of these older versions that processes untrusted PKCS#12 files through the info_as_hash() routine is vulnerable.

Risk and Exploitability

The CVSS score is 7.5, the EPSS score is <1%, and the vulnerability is not listed in CISA KEV. Exploitation requires an attacker to supply a specially crafted PKCS#12 file to a Perl application that calls info_as_hash(). The impact is a crash of the application process, potentially leading to denial of service for users or downtime for services. Remote exploitation is plausible if the application is exposed to external input. While no known public exploits exist, the simplicity of the trigger makes the risk moderate to high for exposed services that process untrusted PKCS#12 files.

Generated by OpenCVE AI on August 13, 2026 at 09:23 UTC.

Remediation

Vendor Solution

Upgrade to Crypt::OpenSSL::PKCS12 1.98 or later, which sizes the buffer on the decoded string length plus one and writes an explicit terminator.

Vendor Workaround

For deployments that cannot upgrade to 1.98, ensure that PKCS#12 files passed to info_as_hash() come from trusted sources.

OpenCVE Recommended Actions

  • Upgrade Crypt::OpenSSL::PKCS12 to version 1.98 or later, which correctly sizes the buffer and includes a string terminator.
  • If an upgrade cannot be performed immediately, ensure that PKCS#12 files passed to info_as_hash() come only from trusted sources or otherwise restrict the use of this routine to internal, authenticated data.
  • Implement additional input validation to reject or sanitize PKCS#12 files containing zero‑length BMPSTRING attributes before calling info_as_hash().

Generated by OpenCVE AI on August 13, 2026 at 09:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 12 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 09 Aug 2026 03:30:00 +0000

Type Values Removed Values Added
First Time appeared Jonasbn
Jonasbn crypt::openssl::pkcs12
Vendors & Products Jonasbn
Jonasbn crypt::openssl::pkcs12

Sun, 09 Aug 2026 01:30:00 +0000

Type Values Removed Values Added
Description Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in print_attribute via a zero length BMPSTRING attribute. print_attribute() sizes the destination buffer for a BMPSTRING attribute from its declared byte length with `Renew(*attribute, length, char)`. A zero length attribute makes that a zero size reallocation, which Perl implements as a free returning NULL, so the buffer pointer becomes NULL, the following `strncpy` copies nothing, and the caller dereferences NULL in the `strlen()` it passes to `newSVpvn()`. A zero length BMPSTRING is even length, so the ASN.1 decoder accepts it and the value reaches this code. The UTF8STRING, OCTET STRING and BIT STRING arms size on `length + 1` or `length * 4 + 1` and are unaffected. Any caller that passes an untrusted PKCS#12 file to info_as_hash() can crash the process. info() prints attribute values directly without sizing a buffer and is unaffected.
Title Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in print_attribute via a zero length BMPSTRING attribute
Weaknesses CWE-476
References

Subscriptions

Jonasbn Crypt::openssl::pkcs12
cve-icon MITRE

Status: PUBLISHED

Assigner: CPANSec

Published:

Updated: 2026-08-12T17:35:54.067Z

Reserved: 2026-07-27T00:17:17.758Z

Link: CVE-2026-17510

cve-icon Vulnrichment

Updated: 2026-08-09T03:32:58.521Z

cve-icon NVD

Status : Deferred

Published: 2026-08-09T02:16:34.117

Modified: 2026-08-26T16:51:19.490

Link: CVE-2026-17510

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-13T09:30:07Z

Weaknesses