CVE-2026-6329

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description PKCS#12 MAC verification uses a comparison length controlled by an attacker, which weakens the integrity check on the Message Authentication Code (MAC) and allows a mismatched MAC to be accepted. The verification path compares the locally computed HMAC against the MAC parsed from the PKCS#12 structure using a length taken directly from the attacker-supplied input, without first verifying that it equals the length of the digest produced by the configured algorithm. Consequently, a zero-length or truncated stored MAC could be accepted, defeating the integrity protection.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.