{"id":"CVE-2026-17510","summary":"Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in print_attribute via a zero length BMPSTRING attribute","details":"Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in print_attribute via a zero length BMPSTRING attribute.\n\nprint_attribute() sizes the destination buffer for a BMPSTRING attribute from its declared byte length with `Renew(*attribute, length, char)`. A zero length attribute makes that a zero size reallocation, which Perl implements as a free returning NULL, so the buffer pointer becomes NULL, the following `strncpy` copies nothing, and the caller dereferences NULL in the `strlen()` it passes to `newSVpvn()`. A zero length BMPSTRING is even length, so the ASN.1 decoder accepts it and the value reaches this code. The UTF8STRING, OCTET STRING and BIT STRING arms size on `length + 1` or `length * 4 + 1` and are unaffected.\n\nAny caller that passes an untrusted PKCS#12 file to info_as_hash() can crash the process. info() prints attribute values directly without sizing a buffer and is unaffected.","modified":"2026-08-28T11:30:51.744298106Z","published":"2026-08-09T01:21:30.439Z","database_specific":{"cna_assigner":"CPANSec","cwe_ids":["CWE-476"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/17xxx/CVE-2026-17510.json"},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/08/09/1"},{"type":"WEB","url":"https://cpan.org/modules"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/17xxx/CVE-2026-17510.json"},{"type":"ADVISORY","url":"https://metacpan.org/release/JONASBN/Crypt-OpenSSL-PKCS12-1.98/source/Changes.md"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17510"},{"type":"FIX","url":"https://github.com/dsully/perl-crypt-openssl-pkcs12/commit/6cb282d8d8e8ded4859551cd2d3cfa7c6028ce48.patch"},{"type":"PACKAGE","url":"https://github.com/dsully/perl-crypt-openssl-pkcs12"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/dsully/perl-crypt-openssl-pkcs12","events":[{"introduced":"0"},{"fixed":"46429a093e1628a709eeea53434c5eef2525c6f7"},{"fixed":"6cb282d8d8e8ded4859551cd2d3cfa7c6028ce48"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"1.98"}],"source":["DESCRIPTION","REFERENCES"]}}],"versions":["v1.97","v1.96","1.95","1.94","1.93","1.92","1.91","1.11","1.10","1.9","1.8","1.7","1.6","1.5","1.4","1.3","1.2","1.1","1.0","0.10","0.9"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-17510.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}