Heap Out of Bounds Read in Crypt::OpenSSL::PKCS12 for Perl

CVE-2026-9265

What is CVE-2026-9265?

Crypt::OpenSSL::PKCS12 versions prior to 1.96 for Perl has a vulnerability wherein the print_attribute() function improperly handles UTF8STRING ASN.1 attributes, leading to a heap out-of-bounds read. The function utilizes strncpy to copy attribute values into a heap buffer defined by the exact length of the input, which results in the absence of a NUL terminator. This oversight allows downstream functions, such as strlen(), to read beyond the intended buffer, leading to potential information disclosure by accessing adjacent heap memory that's influenced by an attacker. It’s crucial for users to update to the patched version to mitigate risks associated with this vulnerability.

References