CVE-2026-8507 Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl have out-of-bounds (OOB) write flaws
A signed integer overflow in Crypt::OpenSSL::PKCS12 allows heap out-of-bounds writes and potential remote code execution when parsing large PKCS12 files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-8507?
CVE-2026-8507 is a critical vulnerability in JONASBN Crypt::OpenSSL::PKCS12, published on 17 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl have out-of-bounds (OOB) write flaws.
When parsing a PKCS12 file, with a >= 1 GiB OCTET STRING (or BIT STRING) attribute on a SAFEBAG, via info() or info_as_hash(), a heap out-of-bounds write would be triggered with remote-code-execution potential (RCE) due to a signed integer overflow in the size calculation passed to Renew().
Weakness: CWE-787
Which versions are affected by CVE-2026-8507?
How do I fix CVE-2026-8507?
Apply the vendor's patch.
Is CVE-2026-8507 being exploited?
There is no known exploitation of CVE-2026-8507 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-8507, GHSA-3qmj-qw66-fwx8, UBUNTU-CVE-2026-8507.