Out-of-bounds Write Vulnerability in OpenSSL PKCS#12 Module

CVE-2025-69419

What is CVE-2025-69419?

A vulnerability in the OpenSSL library allows maliciously crafted PKCS#12 files to trigger an out-of-bounds write when the PKCS12_get_friendlyname() function is called. An attacker can exploit this by using a BMPString (UTF-16BE) friendly name with non-ASCII BMP code points, leading to memory corruption. The flaw originates from incorrect buffer capacity being forwarded during a UTF-8 conversion process, which enables an application to write data outside the allocated heap buffer. This vulnerability affects specific versions of OpenSSL and can potentially disrupt services if exploited.

References