Null Pointer Dereference in Crypt::OpenSSL::PKCS12 by Perl
CVE-2026-17510
Currently unrated
What is CVE-2026-17510?
Crypt::OpenSSL::PKCS12 for Perl versions prior to 1.98 contains a NULL pointer dereference vulnerability caused by a zero-length BMPSTRING attribute. When an untrusted PKCS#12 file is processed via the 'info_as_hash()' method, it can lead to a crash because of improper buffer handling. Specifically, the 'print_attribute()' function reallocates a buffer size based on the zero length attribute, resulting in a NULL pointer dereference during further processing. This issue does not affect the 'info()' function, which handles attribute values without buffer sizing.
Affected Version(s)
Crypt::OpenSSL::PKCS12 0 < 1.98