CVE-2026-9265: Crypt::OpenSSL::PKCS12 versions before 1.96 for Perl permits a heap OOB read in print_attribute UTF8STRING path

Synopsis

A heap out-of-bounds read affects Crypt::OpenSSL::PKCS12 for Perl in all versions before 1.96. The flaw is reachable over the network without authentication: a crafted PKCS12 file triggers the vulnerable print_attribute() code path, which copies a UTF8STRING ASN.1 value into a heap buffer without a NUL terminator, then passes an inflated length to newSVpvn(), leaking adjacent heap bytes into a Perl scalar. Successful exploitation reads sensitive memory contents and can crash the affected process. A patched-image rebuild at version 1.96 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable code is exposed over the network; an attacker can deliver a crafted PKCS12 file to the target service without needing local access.

• AuthenticationNot required

  No credentials are needed; any unauthenticated party that can supply a PKCS12 input to the application can trigger the flaw.

• Victim interactionNot required

  No user action is required beyond the service processing the attacker-supplied PKCS12 file in its normal operation.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, special memory layout, or environmental prerequisites are required.

Blast Radius

• Reads adjacent heap bytes that may contain in-process secrets such as private keys, session tokens, or decrypted plaintext from other PKCS12 operations.
• Leaks the exfiltrated heap content into a Perl scalar that downstream application code may log, serialize, or return in an API response.
• Causes a process crash when strlen() walks past valid heap memory, disrupting availability of any service that parses PKCS12 inputs.
• No write primitive is present in this path, so persistent data integrity is not directly affected by this vulnerability.