CVE Intelligence
Analysis AI-assisted

CVE-2026-9265: Crypt::OpenSSL::PKCS12 for Perl: heap out-of-bounds read in print_attribute (CWE-125)

CVE-2026-9265 affects Crypt::OpenSSL::PKCS12 for Perl before version 1.96, where a heap out-of-bounds read can occur in the UTF8STRING handling of print_attribute. The record rates it critical with a CVSS 3.1 base score of 9.1, and no confirmed exploitation appears in the sources consulted. The referenced 1.96 release notes and commit patch point to upgrading as the main remediation path.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-9265 is a heap out-of-bounds read in Crypt::OpenSSL::PKCS12 for Perl, affecting versions before 1.96. According to the record, a copied UTF8STRING attribute is left without a NUL terminator, and downstream code then reads past the intended length. The weakness is classified as CWE-125, Out-of-bounds Read.

Impact

  • The record states that adjacent heap bytes can be copied into a Perl scalar, which could expose data held in process memory.
  • The recorded CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H, which describes network reachability, low complexity, no privileges, no user interaction, high confidentiality impact, no integrity impact and high availability impact.
  • Whether the impact is reachable in a given application depends on whether that application passes untrusted PKCS12 or ASN.1 content into the affected code path. This is an inference and is not confirmed by the record.

Affected products and versions

  • Crypt::OpenSSL::PKCS12 for Perl, versions before 1.96, as stated in the record description.
  • The structured affected and fixes lists in the record are empty, so exact version ranges rely on the description and the referenced Changes file.

Exploitation status

The record shows that the vulnerability is not listed in the CISA KEV catalog, and no EPSS score is provided. No confirmed exploitation appears in the sources consulted for this analysis.

Remediation and mitigation

  • Inventory systems that use Crypt::OpenSSL::PKCS12 and identify versions earlier than 1.96.
  • Upgrade to version 1.96 or later, then verify the installed version against the release notes at the 1.96 Changes file.
  • Review the upstream commit patch and the upstream issue for context on the change.
  • Where upgrading is not immediately possible, limit exposure of services that parse untrusted PKCS12 files or ASN.1 attribute data using this module, as a temporary defensive measure.

Detection guidance

  • Track installed versions of the module across servers and build images, flagging any version below 1.96.
  • Monitor applications that use the module for unexpected crashes, memory anomalies or unusual output when processing PKCS12 inputs.
  • Treat unexplained errors from certificate or key import workflows as signals for deeper review, without relying on this as a conclusive indicator.

Limitations of the available information

  • The record does not include structured affected version ranges, fixed version fields or reproduction details.
  • The CVSS data is present, but the record does not include an EPSS score, an SSVC value or a confirmed exploitation timeline.
  • The source status is recorded as Deferred, so the sources consulted may change after publication.
  • The link between version 1.96 and the fix is inferred from the references and is not explicitly stated in the record text.

Frequently asked questions

Is CVE-2026-9265 being actively exploited?

The record shows the vulnerability is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted. No EPSS score is provided in the record.

Which version should I upgrade to?

The record states that versions before 1.96 are affected. The referenced 1.96 Changes file and commit patch support upgrading to 1.96 or later, and you should confirm the exact fix in the release notes.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.