CVE-2026-17510: Perl PKCS12 Use-After-Free Vulnerability

CVE-2026-17510 Overview

CVE-2026-17510 is a NULL pointer dereference vulnerability in the Perl module Crypt::OpenSSL::PKCS12 before version 1.98. The flaw resides in the print_attribute() function when processing a zero-length BMPSTRING attribute inside a PKCS#12 file. A crafted certificate archive causes a zero-size buffer reallocation, which Perl's allocator treats as a free returning NULL. A subsequent strlen() call dereferences that NULL pointer and crashes the calling process. Any application that parses untrusted PKCS#12 input through info_as_hash() is exposed. The issue is tracked as [CWE-476: NULL Pointer Dereference].

Critical Impact
Remote attackers can crash any Perl process that calls info_as_hash() on an attacker-supplied PKCS#12 file, producing an availability-focused denial of service.

Affected Products

Crypt::OpenSSL::PKCS12 for Perl, all versions before 1.98
Any Perl application that invokes info_as_hash() on untrusted PKCS#12 input
Downstream tooling that consumes attacker-controlled certificate archives via this module

Discovery Timeline

2026-08-09 - CVE-2026-17510 published to the National Vulnerability Database
2026-08-12 - Record last updated in the NVD database

Technical Details for CVE-2026-17510

Vulnerability Analysis

The defect lives in the V_ASN1_BMPSTRING branch of print_attribute() inside PKCS12.xs. The function sizes its destination buffer from the attribute's declared byte length with Renew(*attribute, length, char). A zero-length BMPSTRING makes that a zero-size reallocation. Perl's safesysrealloc implements a zero size as a free that returns NULL, so *attribute becomes NULL. The following strncpy copies nothing, and the caller then passes the pointer to newSVpvn() with a strlen() argument that dereferences NULL.

A zero-length BMPSTRING has an even byte length, so the ASN.1 decoder accepts it and the malformed value reaches the vulnerable code path. The sibling UTF8STRING, OCTET STRING, and BIT STRING branches size their buffers on length + 1 or length * 4 + 1, which never degenerates to zero, and are unaffected. The info() entry point prints attribute values directly through BIO_printf without allocating a buffer, so it is also unaffected. Only callers reaching info_as_hash() trigger the crash.

Root Cause

The root cause is unsafe buffer sizing driven by an attacker-controlled ASN.1 length field. Renew(*attribute, length, char) trusts a length value of 0 and produces a NULL buffer, while downstream code assumes the buffer is a valid NUL-terminated C string.

Attack Vector

An attacker delivers a PKCS#12 file containing a certBag attribute whose value is a zero-length ASN.1 BMPSTRING. When a Perl application calls info_as_hash() on that file, the process dereferences NULL and terminates. Exploitation requires no authentication and no user interaction beyond parsing the file.

text

     if (length < 0 || length > (INT_MAX - 1))
       croak("BMPSTRING attribute length out of range (got %d)", length);
     value = OPENSSL_uni2asc(av->value.bmpstring->data, length);
+    /* Defensive: OPENSSL_uni2asc returns NULL on allocation failure, and on
+       an odd-length BMPSTRING. Guard before either branch dereferences it:
+       the else branch below passes value to BIO_printf. */
+    if (value == NULL)
+      croak("BMPSTRING attribute could not be decoded");
     if(*attribute != NULL) {
-      Renew(*attribute, length, char);
-      strncpy(*attribute, value, length);
+      /* uni2asc returns a NUL-terminated C string whose length can be shorter
+         than `length` (each UTF-16 unit -> one ASCII byte), and is 0 for an
+         empty BMPSTRING. Size the buffer on strlen(value) + 1 and write an
+         explicit terminator. */
+      size_t vlen = strlen(value);
+      Renew(*attribute, vlen + 1, char);
+      memcpy(*attribute, value, vlen);
+      (*attribute)[vlen] = '\0';
     } else {
       BIO_printf(out, "%s\n", value);
     }

Source: GitHub Commit Patch

Detection Methods for CVE-2026-17510

Indicators of Compromise

Unexpected SIGSEGV crashes in Perl processes that call Crypt::OpenSSL::PKCS12::info_as_hash() on external input.
Core dumps whose faulting frame is inside print_attribute or strlen called from newSVpvn.
PKCS#12 files containing certBag attributes with a zero-length V_ASN1_BMPSTRING value, for example an attribute at a custom OID such as 1.2.3.4.6.

Detection Strategies

Inventory installed Perl modules with cpanm --info Crypt::OpenSSL::PKCS12 or corelist and flag versions below 1.98.
Inspect PKCS#12 uploads with openssl asn1parse and alert on BMPSTRING elements with length 0.
Correlate abnormal Perl process termination with recent PKCS#12 ingestion events in application logs.

Monitoring Recommendations

Monitor certificate-processing services and API endpoints for repeated worker crashes or restart loops.
Log the source, size, and hash of every PKCS#12 file submitted by external users for post-incident review.
Enable ASan or Valgrind in staging when validating upgrades to the Crypt::OpenSSL::PKCS12 module.

How to Mitigate CVE-2026-17510

Immediate Actions Required

Upgrade Crypt::OpenSSL::PKCS12 to version 1.98 or later on every host that parses PKCS#12 input.
Audit application code for calls to info_as_hash() and gate them behind input validation until the patch lands.
Restrict who can submit PKCS#12 files to production parsers, and require authentication where feasible.

Patch Information

The upstream fix sizes the destination buffer on strlen(value) + 1 and writes an explicit NUL terminator, so an empty BMPSTRING resolves to an empty C string instead of a NULL pointer. It also guards against OPENSSL_uni2asc() returning NULL. Details are in the GitHub Commit Patch and the MetaCPAN Release Changes. Additional discussion is available on the Openwall OSS-Security thread.

Workarounds

Replace info_as_hash() calls with info() where the hash form is not required, since info() is unaffected.
Pre-validate PKCS#12 input by rejecting archives whose attributes contain zero-length BMPSTRING values.
Run PKCS#12 parsing in an isolated worker process with automatic restart to contain crash impact.

bash

# Upgrade the vulnerable Perl module to the patched release
cpanm Crypt::OpenSSL::PKCS12@1.98

# Verify the installed version
perl -MCrypt::OpenSSL::PKCS12 -e 'print $Crypt::OpenSSL::PKCS12::VERSION, "\n"'

# Screen incoming PKCS#12 files for zero-length BMPSTRING attributes
openssl asn1parse -inform DER -in suspect.p12 | grep 'BMPSTRING' | awk '$3==0 {exit 1}'