CVE-2026-9265 | BDVDB-2026-341848 Detail

Description#

Crypt::OpenSSL::PKCS12 versions before 1.96 for Perl permits a heap OOB read in print_attribute UTF8STRING path. print_attribute() copies a UTF8STRING ASN.1 attribute value into a heap buffer sized exactly to its declared length via strncpy, leaving no NUL terminator. Downstream callers run strlen() on the result and pass the inflated length to newSVpvn(), copying attacker-influenced adjacent heap bytes into a Perl scalar.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-06-20Record published in the CVE List.
2. Version 22026-06-22Most recent update recorded in the CVE List.