CVE-2026-17510 JONASBN CVE debrief

Who should care

Users of Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl, especially those handling untrusted PKCS#12 files, should be aware of this vulnerability and take necessary actions to mitigate the risk.

Technical summary

The vulnerability exists in the print_attribute function of Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl. A zero-length BMPSTRING attribute causes a NULL pointer dereference. The ASN.1 decoder accepts zero-length BMPSTRING values, allowing the exploit. Other string types like UTF8STRING, OCTET STRING, and BIT STRING are unaffected due to different sizing calculations. Any caller that passes an untrusted PKCS#12 file to info_as_hash() can crash the process.

Defensive priority

This vulnerability allows a NULL pointer dereference in the print_attribute function of Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl, which can be exploited by passing an untrusted PKCS#12 file to info_as_hash().

Recommended defensive actions

• Inventory and verify affected systems running Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl.
• Apply the vendor remediation by updating to version 1.98 or later.
• Implement compensating controls such as validating and sanitizing input PKCS#12 files.
• Monitor for suspicious activity related to untrusted PKCS#12 files.
• Exception tracking for any system that cannot be updated immediately.

Evidence notes

The vulnerability exists in the print_attribute function where a zero-length BMPSTRING attribute causes a NULL pointer dereference. The ASN.1 decoder accepts zero-length BMPSTRING values, allowing the exploit. Other string types like UTF8STRING, OCTET STRING, and BIT STRING are unaffected due to different sizing calculations.

Official resources