A vulnerability in OpenSSL's PKCS#12 parsing allows a type confusion error when an ASN1_TYPE union member is accessed without validating the type. This leads to an invalid pointer access, which can cause a controlled denial of service by crashing the application. The flaw is limited to a 1-byte address space, so the crash is deterministic because the pointer will target the zero page, which is unmapped on most operating systems.

Affected configurations include OpenSSL releases 1.1.1, 3.0, 3.3, 3.4, 3.5, and 3.6. The FIPS modules (3.5, 3.4, 3.3, 3.0) are excluded because the code lies outside the FIPS boundary, and OpenSSL 1.0.2 is unaffected.

The CVSS score is 5.5, indicating low severity, and the EPSS score is below 1%, so the exploitation probability is very low. The vulnerability is not in the CISA KEV catalog, and the attack requires a user or application to process a maliciously crafted PKCS#12 file, which is uncommon. Consequently, the risk is limited but still warrants addressing, especially in environments that load untrusted PKCS#12s or in high-security contexts.