CVE-2026-8507criticalCWE-787

CVE-2026-8507: critical vulnerability in JONASBN Crypt::OpenSSL::PKCS12

Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl have out-of-bounds (OOB) write flaws

Published · Updated

Follow this CVE+ Monitor Crypt::OpenSSL::PKCS12+ Monitor libcrypt-openssl-pkcs12-perl

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.8epss 0.6%
Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl have out-of-bounds (OOB) write flaws. When parsing a PKCS12 file, with a >= 1 GiB OCTET STRING (or BIT STRING) attribute on a SAFEBAG, via info() or info_as_hash(), a heap out-of-bounds write would be triggered with remote-code-execution potential (RCE) due to a signed integer overflow in the size calculation passed to Renew().
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
JONASBN · Crypt::OpenSSL::PKCS12
Related CVEs — JONASBN Crypt::OpenSSL::PKCS12

In the same product, most dangerous first.

CVE-2026-9265CRITICALCrypt::OpenSSL::PKCS12 versions before 1.96 for Perl permits a heap OOB read in print_attribute UTF8STRING pathEPSS 0.6%CVE-2026-17510HIGHCrypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in print_attribute via a zero length BMPSTRING attributeEPSS 0.6%CVE-2026-8721CRITICALCrypt::OpenSSL::PKCS12 versions through 1.94 for Perl truncates passwords with embedded NULLsEPSS 0.4%