CVE-2026-8507: Crypt::OpenSSL::PKCS12 for Perl - out-of-bounds write when parsing PKCS12 files
CVE-2026-8507 affects Crypt::OpenSSL::PKCS12 for Perl, with the affected range recorded as versions through 1.94. Processing a crafted PKCS12 file through info() or info_as_hash() can trigger a heap out-of-bounds write caused by a signed integer overflow, with potential for remote code execution. Both recorded CVSS 3.1 scores are 9.8, and no confirmed exploitation appears in the sources consulted.
Overview
CVE-2026-8507 is a weakness classified as CWE-787 (Out-of-bounds Write) in Crypt::OpenSSL::PKCS12 for Perl. According to the NVD record, the flaw is triggered when a PKCS12 file containing a very large OCTET STRING or BIT STRING attribute inside a SAFEBAG is parsed through info() or info_as_hash(). The CNA is CPANSec and the record was published on 2026-05-17.
Impact
The record states that the out-of-bounds write occurs in heap memory and has remote code execution potential. The root cause is a signed integer overflow in the size calculation passed to Renew(). Both recorded CVSS 3.1 scores are 9.8, with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which indicates network attack vector, no privileges and no user interaction. The SSVC data in the record lists technical impact as total and automatable as yes.
Affected products and versions
- Product listed in the record: JONASBN Crypt::OpenSSL::PKCS12.
- Affected range listed in the record: versions up to and including 1.94.
- The record does not list any fixed version. The release notes for 1.95 and a patch commit are referenced, but the record does not explicitly state that version 1.95 contains the fix.
Exploitation status
The KEV catalog flag in the record is false, so this vulnerability is not reported there as exploited in the wild. The SSVC exploitation field is none. The EPSS probability is 0.00801 (percentile 0.55484) with the date recorded as 2026-10-13. No confirmed exploitation appears in the sources consulted.
Remediation and mitigation
- Identify every system that uses Crypt::OpenSSL::PKCS12 and record the installed version.
- Prioritize upgrading to a release newer than 1.94, such as the version referenced in the 1.95 release notes, after verifying the change against the project documentation.
- Until patched, avoid parsing PKCS12 files from untrusted sources with the affected functions, and restrict such processing to isolated components with limited privileges.
- Review the upstream issue tracker and the related issue 55 for project status.
Detection guidance
- Inventory Perl applications and dependencies that load Crypt::OpenSSL::PKCS12.
- Log and review failures, crashes or abnormal memory behavior in services that parse PKCS12 input, especially when inputs are unusually large.
- Watch for unexpected termination of Perl processes handling certificate or PKCS12 uploads.
Limitations of the available information
The record lacks a structured fixed version, and its fixes list is empty. The sources do not provide a detailed technical analysis of the memory layout, and no independent confirmation of exploitability beyond the stated description was found in the consulted data. The EPSS date in the record is later than the publication date and should be verified against the current source.
Frequently asked questions
What is CVE-2026-8507?
It is an out-of-bounds write weakness (CWE-787) in Crypt::OpenSSL::PKCS12 for Perl, affecting versions listed as up to 1.94. The record reports potential remote code execution.
Is this vulnerability known to be exploited?
The KEV flag in the record is false, and no confirmed exploitation appears in the sources consulted.
Which version fixes the issue?
The record does not list a fixed version. Release notes for 1.95 and a patch commit are referenced, but the record does not explicitly confirm that 1.95 contains the fix.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.