PT-2026-41582 · Cpan · Crypt::Openssl::Pkcs12

Published 2026-05-17 · Updated 2026-05-20 · CVE-2026-8507

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Crypt::OpenSSL::PKCS12 versions prior to 1.95

Description An out-of-bounds write flaw exists when parsing a PKCS12 file containing an OCTET STRING or BIT STRING attribute on a SAFEBAG of 1 GiB or larger. This issue is triggered via the info() or info as hash() functions and results from a signed integer overflow in the size calculation passed to the Renew() function, potentially leading to remote code execution.

Recommendations Update to a version later than 1.94. As a temporary workaround, restrict the processing of PKCS12 files containing attributes larger than 1 GiB or limit the use of the info() and info as hash() functions.

Fix

RCE

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2026-8507

Affected Products

Crypt::Openssl::Pkcs12

References · 19

• https://github.com/dsully/perl-crypt-openssl-pkcs12/commit/b9d0469c6d8f5b5c6c2a45a3d0647a532b749397.patch · Patch
• https://cve.org/CVERecord?id=CVE-2026-8507 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-8507 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-8507 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-8507 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-8507 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-8507 · Vendor Advisory
• https://github.com/dsully/perl-crypt-openssl-pkcs12/issues/56 · Note
• https://github.com/dsully/perl-crypt-openssl-pkcs12/issues/55 · Note
• http://openwall.com/lists/oss-security/2026/05/17/5 · Note
• https://twitter.com/CVEnew/status/2056253264996290870 · Twitter Post
• https://t.me/CVEtracker/54073 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2056120540528546047 · Twitter Post
• https://t.me/cveNotify/163792 · Telegram Post
• https://lists.security.metacpan.org/cve-announce/msg/40149247 · Note