EUVD-2026-38103
GHSA-597h-8vxx-6jqw
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Heap out-of-bounds read in the Perl module Crypt::OpenSSL::PKCS12 before version 1.96 lets a crafted PKCS#12 file leak adjacent process heap memory into Perl scalars when its attributes are printed. Because print_attribute() copies a UTF8STRING value with strncpy into a buffer sized to the exact declared length and never NUL-terminates it, downstream strlen()/newSVpvn() reads past the buffer end. No public exploit identified at time of analysis, EPSS is low (0.35%), and it is not on CISA KEV, but the SSVC framework flags it as automatable with partial technical impact.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Crypt gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Primary rating from Vendor (CPANSec) · only source for this CVE.
CVSS VectorVendor: CPANSec
Lifecycle Timeline
2DescriptionCVE.org
Crypt::OpenSSL::PKCS12 versions before 1.96 for Perl permits a heap OOB read in print_attribute UTF8STRING path.
print_attribute() copies a UTF8STRING ASN.1 attribute value into a heap buffer sized exactly to its declared length via strncpy, leaving no NUL terminator. Downstream callers run strlen() on the result and pass the inflated length to newSVpvn(), copying attacker-influenced adjacent heap bytes into a Perl scalar.
Executive ViewAI
Crypt::OpenSSL::PKCS12, a Perl module for cryptographic certificate handling, contains a critical information disclosure vulnerability (CVE-2026-9265) affecting versions before 1.96. When processing externally-sourced PKCS#12 certificate files, the module can leak sensitive data from application memory to attackers, potentially exposing cryptographic material or credentials. Organizations relying on this module for certificate management must patch immediately to prevent unauthorized data exposure.
Within 24 hours, identify all systems and applications using Crypt::OpenSSL::PKCS12 through dependency scanning and package managers. Within 7 days, test and deploy Crypt::OpenSSL::PKCS12 version 1.96 or later to all affected systems, prioritizing production environments and systems processing untrusted certificate files. Complete deployment verification within 30 days using automated scanning to confirm no instances of vulnerable versions remain in production.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Predictable salt generation in Crypt::Password through version 0.28 for Perl weakens the security of stored password has
Perl Crypt::NaCl::Sodium module through 2.002 has potential integer overflows in cryptographic operations that could wea
Crypt::Sodium::XS for Perl bundles a vulnerable version of libsodium (<= 1.0.20) that has a signature verification flaw.
Heap out-of-bounds read in the Crypt::OpenSSL::X509 Perl module (versions before 2.1.3) lets a crafted X.509 certificate
Integer overflow in Crypt::NaCl::Sodium Perl module through version 2.001 on 32-bit systems. The Sodium.xs binding casts
Private-key recovery in the Crypt::DSA Perl module (all versions before 1.22) stems from a biased random number generato
NULL pointer dereference in Crypt::OpenSSL::PKCS12 before version 1.98 for Perl enables process crashes when any caller
Timing side-channel in the Crypt::Password Perl module (versions through 0.28) allows attackers to incrementally guess a
Denial of service in the Crypt::OpenSSL::X509 Perl module before 2.1.3 lets a malformed X.509 certificate crash any Perl
Heap buffer overflow in Crypt::SysRandom::XS before version 0.010 allows denial of service through negative length param
Heap buffer overflow in Perl's Crypt::URandom module (versions 0.41-0.54) allows denial of service through integer wrapa
Crypt::Sodium::XS versions through 0.001000 for Perl has potential integer overflows. Combined aead encryption, combined
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allVendor StatusVendor
Debian
Bug #1140426| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | vulnerable | 1.3-1 | - |
| trixie | vulnerable | 1.94-1 | - |
| forky, sid | vulnerable | 1.95-1 | - |
| (unstable) | fixed | (unfixed) | - |
Exploit-DB