CVE-2026-17510

Name of the Vulnerable Software and Affected Versions Crypt::OpenSSL::PKCS12 versions prior to 1.98

Description A NULL pointer dereference occurs in the print attribute() function when processing a zero length BMPSTRING attribute. The function uses Renew(*attribute, length, char) to size the destination buffer based on the declared byte length. A zero length attribute results in a zero size reallocation, which Perl implements as a free returning NULL. Consequently, the buffer pointer becomes NULL, and the caller dereferences this NULL pointer during a strlen() call passed to newSVpvn(). This issue can be triggered when an untrusted PKCS#12 file is passed to the info as hash() function, potentially leading to a process crash. UTF8STRING, OCTET STRING, and BIT STRING attributes are not affected as they use different sizing logic.

Recommendations Update Crypt::OpenSSL::PKCS12 to version 1.98 or later. Avoid passing untrusted PKCS#12 files to the info as hash() function.