CVE-2026-8507: Crypt::OpenSSL::PKCS12 Heap OOB Write — CVSS 9.8 Critical

Executive Summary

A critical heap out-of-bounds write vulnerability (CVE-2026-8507) has been disclosed in Crypt::OpenSSL::PKCS12, a widely used Perl CPAN module for parsing and generating PKCS#12 certificate bundles (.p12 / .pfx files). All versions through 1.94 are affected.

CVSS Score: 9.8 (Critical)

When parsing a PKCS12 file that contains a SAFEBAG with a malformed attribute — specifically an OCTET STRING or BIT STRING with a size of 1 GiB or larger — the module triggers a heap out-of-bounds write via the info() or info_as_hash() methods. This flaw carries remote code execution potential wherever Perl applications process untrusted PKCS12 files without prior validation.

Vulnerability Overview

Affected Products

Technical Analysis

Root Cause

The vulnerability exists in the PKCS12 attribute parsing logic within Crypt::OpenSSL::PKCS12. When a SAFEBAG in the PKCS12 structure contains an OCTET STRING or BIT STRING attribute with a declared length exceeding 1 GiB, the underlying heap buffer allocation does not correctly account for the full data size. The resulting write operation extends beyond the allocated heap buffer boundary, corrupting adjacent memory.

This class of heap OOB write vulnerability can typically be exploited to achieve arbitrary code execution through controlled heap layout manipulation.

Vulnerable Code Paths

Both the info() and info_as_hash() methods trigger the vulnerable parsing path when called on a crafted PKCS12 object:

use Crypt::OpenSSL::PKCS12;
 
# Loading attacker-controlled PKCS12 file
my $p12 = Crypt::OpenSSL::PKCS12->new_from_file('malicious.p12');
 
# Either of these triggers the OOB write on malformed input:
my $info = $p12->info();          # vulnerable
my %hash = $p12->info_as_hash();  # vulnerable

Attack Scenarios

Impact Assessment

Immediate Remediation

Step 1: Check Installed Version

perl -MCrypt::OpenSSL::PKCS12 -e 'print $Crypt::OpenSSL::PKCS12::VERSION, "\n"'

If the output is 1.94 or lower, the installation is vulnerable.

Step 2: Upgrade via CPAN

# Using cpanm (recommended)
cpanm Crypt::OpenSSL::PKCS12
 
# Using the CPAN shell
perl -MCPAN -e 'install Crypt::OpenSSL::PKCS12'
 
# Using system package manager (Debian/Ubuntu)
sudo apt-get update && sudo apt-get install libcrypt-openssl-pkcs12-perl
 
# On RHEL/CentOS/Rocky via EPEL
sudo dnf update perl-Crypt-OpenSSL-PKCS12

Step 3: Add Input Validation (Defense in Depth)

Until patched, add file size validation before parsing any externally sourced PKCS12 files:

use Crypt::OpenSSL::PKCS12;
use File::stat;
 
sub safe_parse_pkcs12 {
    my ($file_path) = @_;
 
    # Reject files larger than 50 MB before parsing
    my $stat = stat($file_path) or die "Cannot stat file: $!";
    die "PKCS12 file exceeds maximum safe size" if $stat->size > 52_428_800;
 
    return Crypt::OpenSSL::PKCS12->new_from_file($file_path);
}

Step 4: Audit Applications

Search your codebase for PKCS12 parsing calls that accept external input:

# Find Perl files using Crypt::OpenSSL::PKCS12
grep -rl 'Crypt::OpenSSL::PKCS12' /path/to/project/
 
# Find calls to the vulnerable methods
grep -rn 'info_as_hash\|->info()' /path/to/project/ --include='*.pl' --include='*.pm'

Detection

Monitor for PKCS12 parsing failures and abnormal process behavior in applications that process externally-sourced certificates.

Post-Remediation Checklist

1. Upgrade Crypt::OpenSSL::PKCS12 to the patched version on all systems
2. Audit all applications and scripts that call info() or info_as_hash() on untrusted PKCS12 input
3. Add file size limits on any endpoint or script accepting PKCS12 uploads
4. Review logs for abnormally large PKCS12 file submissions prior to patching
5. Test patched version in staging before production rollout
6. Alert security operations if exploitation indicators are present

References

• NVD — CVE-2026-8507
• CPAN — Crypt::OpenSSL::PKCS12
• CISA — Known Exploited Vulnerabilities Catalog