CVE-2026-9265 Crypt::OpenSSL::PKCS12 versions before 1.96 for Perl permits a heap OOB read in print_attribute UTF8STRING path
An attacker can trigger a heap out-of-bounds read in the Perl Crypt::OpenSSL::PKCS12 library, potentially disclosing sensitive memory contents.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-9265?
CVE-2026-9265 is a critical memory corruption vulnerability in JONASBN Crypt::OpenSSL::PKCS12, published on 20 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Crypt::OpenSSL::PKCS12 versions before 1.96 for Perl permits a heap OOB read in print_attribute UTF8STRING path.
print_attribute() copies a UTF8STRING ASN.1 attribute value into a heap buffer sized exactly to its declared length via strncpy, leaving no NUL terminator. Downstream callers run strlen() on the result and pass the inflated length to newSVpvn(), copying attacker-influenced adjacent heap bytes into a Perl scalar.
Weakness: CWE-125
Which versions are affected by CVE-2026-9265?
How do I fix CVE-2026-9265?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-9265 being exploited?
There is no known exploitation of CVE-2026-9265 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-9265, GHSA-597h-8vxx-6jqw, UBUNTU-CVE-2026-9265.