Invalid Pointer Dereference in OpenSSL Parsing of Malformed PKCS#12 Files

CVE-2026-22795

What is CVE-2026-22795?

An application processing a malformed PKCS#12 file can suffer from an invalid or NULL pointer dereference, leading to a Denial of Service. The issue arises when the ASN1_TYPE union is accessed without validating the type, triggering a read from an invalid memory address. This vulnerability is limited to a confined memory space, typically causing a crash due to attempts to manipulate unmapped addresses. While exploiting this requires processing untrusted PKCS#12 files—rare in practice—affected versions of OpenSSL could potentially face service interruptions unless patched.

References