CVE-2026-9265

Name of the Vulnerable Software and Affected Versions Crypt::OpenSSL::PKCS12 versions prior to 1.96

Description A heap out-of-bounds read is possible in the UTF8STRING path of the print attribute() function. The function copies a UTF8STRING ASN.1 attribute value into a heap buffer sized exactly to its declared length using strncpy, which fails to include a NUL terminator. Consequently, downstream callers executing strlen() on the result pass an inflated length to newSVpvn(), allowing adjacent heap bytes influenced by an attacker to be copied into a Perl scalar.

Recommendations Update to version 1.96 or later.