CVE-2026-9265: Perl Crypt::OpenSSL::PKCS12 Buffer Overflow

CVE-2026-9265 Overview

CVE-2026-9265 is a heap out-of-bounds read vulnerability in the Crypt::OpenSSL::PKCS12 Perl module versions before 1.96. The flaw resides in the print_attribute() function within the UTF8STRING ASN.1 attribute handling path. The function copies attribute data into a heap buffer sized exactly to the declared length via strncpy, leaving no NUL terminator. Downstream callers then invoke strlen() on the unterminated buffer and pass the inflated length to newSVpvn(), copying adjacent heap memory into a Perl scalar. Attackers supplying a crafted PKCS#12 file can trigger disclosure of adjacent heap bytes and induce process instability.

Critical Impact
Parsing an attacker-controlled PKCS#12 file leaks adjacent heap memory into Perl scalars and can crash the calling process.

Affected Products

Crypt::OpenSSL::PKCS12 Perl module versions prior to 1.96
Perl applications and services that parse untrusted PKCS#12 files using this module
Downstream distributions packaging vulnerable releases from CPAN

Discovery Timeline

2026-06-20 - CVE-2026-9265 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2026-9265

Vulnerability Analysis

The vulnerability is classified as an Out-of-Bounds Read [CWE-125]. The print_attribute() function in PKCS12.xs allocates a heap buffer matching the ASN.1 UTF8STRING declared length and copies the value with strncpy. Because strncpy does not append a terminator when source and destination lengths match, the resulting C string is unterminated. Downstream Perl glue code calls strlen() on the buffer, walking past the allocation until a stray NUL byte is found in adjacent heap memory. The inflated length is then handed to newSVpvn(), which copies the over-read bytes into a Perl scalar that may be returned, logged, or printed by the caller.

Root Cause

The root cause is missing NUL termination combined with absent bounds validation on the ASN.1 length field. The original code performed no sanity check on av->value.utf8string->length and provided no slot for a terminator. Any caller that treats the resulting buffer as a C string reads beyond the allocation.

Attack Vector

An attacker delivers a malicious PKCS#12 file containing a crafted UTF8STRING attribute to a service or tool that uses Crypt::OpenSSL::PKCS12 to parse certificate bundles. Common targets include automated certificate processors, mail systems, CI/CD signing pipelines, and identity provisioning workflows. Exploitation requires no authentication or user interaction beyond accepting the file for parsing.

text

  case V_ASN1_UTF8STRING:
    if(*attribute != NULL) {
-     Renew(*attribute, av->value.utf8string->length, char);
+     if (av->value.utf8string->length < 0 || av->value.utf8string->length > (INT_MAX - 1))
+       croak("UTF8STRING attribute length out of range (got %d)", av->value.utf8string->length);
+     Renew(*attribute, (size_t)av->value.utf8string->length + 1, char);
      strncpy(*attribute, (const char * ) av->value.utf8string->data, av->value.utf8string->length);
+     (*attribute)[av->value.utf8string->length] = '\0';
    } else {
      BIO_printf(out, "%.*s\n", av->value.utf8string->length,
                   av->value.utf8string->data);

Source: GitHub Patch Commit a7bd2f3

The patch validates the declared length, allocates one extra byte, and explicitly NUL terminates the buffer.

Detection Methods for CVE-2026-9265

Indicators of Compromise

Perl processes terminating with segmentation faults while parsing PKCS#12 input
Anomalous binary content appearing in scalars derived from PKCS#12 attribute reads, such as log entries or audit fields containing non-printable bytes
Unexpected memory or heap corruption warnings emitted by Perl when invoking Crypt::OpenSSL::PKCS12

Detection Strategies

Inventory installed Perl modules and identify any Crypt::OpenSSL::PKCS12 version below 1.96 using cpanm --info or distribution package metadata
Inspect application logs for print_attribute callers handling externally supplied .p12 or .pfx files
Flag PKCS#12 attribute values whose decoded UTF8STRING length is negative, zero, or close to INT_MAX

Monitoring Recommendations

Monitor file ingestion endpoints that accept PKCS#12 bundles for abnormal file sizes or repeated parse failures
Alert on Perl interpreter crashes correlated with certificate or keystore processing jobs
Track outbound data from systems that print or transmit PKCS#12 attribute strings to detect potential heap content leakage

How to Mitigate CVE-2026-9265

Immediate Actions Required

Upgrade Crypt::OpenSSL::PKCS12 to version 1.96 or later from CPAN on every affected host
Audit applications and pipelines that parse PKCS#12 files supplied by external or untrusted sources
Restrict and validate PKCS#12 inputs at the application boundary until the patched module is deployed

Patch Information

The fix is published in Crypt-OpenSSL-PKCS12-1.96 on CPAN. The patch is committed as a7bd2f3 in the upstream repository and is referenced from GitHub Issue #55 and the MetaCPAN Release Changes. The patch adds a length bounds check, allocates one additional byte, and writes a NUL terminator after strncpy.

Workarounds

Reject PKCS#12 files from untrusted sources at the application or proxy layer until the module is upgraded
Sandbox Perl workers that parse PKCS#12 input using isolated user accounts, seccomp, or container restrictions to contain memory disclosure
Pre-validate ASN.1 attribute lengths with a trusted parser such as openssl pkcs12 -info before passing files to the Perl module

bash

# Upgrade the module to the patched release
cpanm Crypt::OpenSSL::PKCS12@1.96

# Verify the installed version
perl -MCrypt::OpenSSL::PKCS12 -e 'print $Crypt::OpenSSL::PKCS12::VERSION, "\n"'