PT-2026-51127 · Jonasbn · Crypt::Openssl::Pkcs12

Publicado 2026-06-20 · Atualizado 2026-06-20 · CVE-2026-9265

Mitre

Crypt::OpenSSL::PKCS12 versions before 1.96 for Perl permits a heap OOB read in print attribute UTF8STRING path.

print attribute() copies a UTF8STRING ASN.1 attribute value into a heap buffer sized exactly to its declared length via strncpy, leaving no NUL terminator. Downstream callers run strlen() on the result and pass the inflated length to newSVpvn(), copying attacker-influenced adjacent heap bytes into a Perl scalar.

Out of bounds Read

Enumeração de Fraquezas

CWE-125

Identificadores relacionados

CVE-2026-9265

Produtos afetados

Crypt::Openssl::Pkcs12

Referências · 4

• https://github.com/dsully/perl-crypt-openssl-pkcs12/issues/55 · Nota
• https://metacpan.org/release/JONASBN/Crypt-OpenSSL-PKCS12-1.96/source/Changes.md · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-9265 · Nota de Segurança
• https://github.com/dsully/perl-crypt-openssl-pkcs12/commit/a7bd2f319fa8aab8177b3d767ea06dd85ceb3173.patch · Correção