The proximity of the bug lies in the NULL pointer dereference that occurs when Crypt::OpenSSL::X509 attempts to parse certain X.509 certificate extensions. When functions such as X509V3_EXT_d2i return NULL, the code immediately dereferences the result without performing checks. This behavior triggers a segmentation fault (SIGSEGV) that crashes the Perl interpreter, effectively denying service to any process that has loaded the affected extension.

The vulnerability affects the Perl module Crypt::OpenSSL::X509 provided by vendor JONASBN. All releases prior to version 2.1.3 are affected. The flaw is exploitable whenever an application invokes the vulnerable helper functions on extensions originating from untrusted or malicious certificates.

With a CVSS score of 7.5, this vulnerability is considered high severity. The EPSS score is <1%, indicating a very low probability of exploitation, and it is not listed in the CISA KEV catalog. The likely attack vector is the delivery of a crafted certificate to an application that processes certificate extensions; the attacker may be local or remote depending on how the application receives certificates. When a vulnerable helper function is invoked with a malicious extension, the Perl process is terminated, requiring a restart or crash recovery.