This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-9265 →

DEBIAN-CVE-2026-9265

Crypt::OpenSSL::PKCS12 versions before 1.96 for Perl permits a heap OOB read in print_attribute UTF8STRING path. print_attribute() copies a UTF8STRIN...

Original description

The description as published by the source.

Crypt::OpenSSL::PKCS12 versions before 1.96 for Perl permits a heap OOB read in print_attribute UTF8STRING path. print_attribute() copies a UTF8STRING ASN.1 attribute value into a heap buffer sized exactly to its declared length via strncpy, leaving no NUL terminator. Downstream callers run strlen() on the result and pass the inflated length to newSVpvn(), copying attacker-influenced adjacent heap bytes into a Perl scalar.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:13 libcrypt-openssl-pkcs12-perl

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 libcrypt-openssl-pkcs12-perl

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.96-1"}]}]

References

advisory security-tracker.debian.org