---
id: CVE-2025-69421
title: NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function
summary: |-
  Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer
  dereference in the PKCS12_item_decrypt_d2i_ex() function.

  Impact summary: A NULL pointer dereference can trigger a crash which leads to
  Denial of Service for …
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: adp
cwe:
  - CWE-476
vendor: OpenSSL
product: OpenSSL
affected:
  - OpenSSL >= 3.6.0 < 3.6.1
  - OpenSSL >= 3.5.0 < 3.5.5
  - OpenSSL >= 3.4.0 < 3.4.4
  - OpenSSL >= 3.3.0 < 3.3.6
  - OpenSSL >= 3.0.0 < 3.0.19
  - OpenSSL >= 1.1.1 < 1.1.1ze
  - OpenSSL >= 1.0.2 < 1.0.2zn
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-01-28T15:17:58.059460Z'
exploitAvailable: true
published: '2026-01-27'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T01:10:29.317Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-69421'
references:
  - url: 'https://openssl-library.org/news/secadv/20260127.txt'
    label: OpenSSL Advisory
  - url: >-
      https://github.com/openssl/openssl/commit/a2dbc539f0f9cc63832709fa5aa33ad9495eb19c
    label: 3.6.1 git commit
  - url: >-
      https://github.com/openssl/openssl/commit/3524a29271f8191b8fd8a5257eb05173982a097b
    label: 3.5.5 git commit
  - url: >-
      https://github.com/openssl/openssl/commit/643986985cd1c21221f941129d76fe0c2785aeb3
    label: 3.4.4 git commit
  - url: >-
      https://github.com/openssl/openssl/commit/4bbc8d41a72c842ce4077a8a3eccd1109aaf74bd
    label: 3.3.6 git commit
  - url: >-
      https://github.com/openssl/openssl/commit/36ecb4960872a4ce04bf6f1e1f4e78d75ec0c0c7
    label: 3.0.19 git commit
tags:
  - cve.org
  - exploit-available
epss: 0.00958
epssPercentile: 0.60672
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/Kha-Beleh/PoC-CVE-2025-69421'
  checkedAt: '2026-10-15T05:53:20.621Z'
ingestedAt: '2026-10-15T05:52:46.060Z'
---

## Overview

Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer
dereference in the PKCS12_item_decrypt_d2i_ex() function.

Impact summary: A NULL pointer dereference can trigger a crash which leads to
Denial of Service for an application processing PKCS#12 files.

The PKCS12_item_decrypt_d2i_ex() function does not check whether the oct
parameter is NULL before dereferencing it. When called from
PKCS12_unpack_p7encdata() with a malformed PKCS#12 file, this parameter can
be NULL, causing a crash. The vulnerability is limited to Denial of Service
and cannot be escalated to achieve code execution or memory disclosure.

Exploiting this issue requires an attacker to provide a malformed PKCS#12 file
to an application that processes it. For that reason the issue was assessed as
Low severity according to our Security Policy.

The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,
as the PKCS#12 implementation is outside the OpenSSL FIPS module boundary.

OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.

## Affected

- `OpenSSL >= 3.6.0 < 3.6.1`
- `OpenSSL >= 3.5.0 < 3.5.5`
- `OpenSSL >= 3.4.0 < 3.4.4`
- `OpenSSL >= 3.3.0 < 3.3.6`
- `OpenSSL >= 3.0.0 < 3.0.19`
- `OpenSSL >= 1.1.1 < 1.1.1ze`
- `OpenSSL >= 1.0.2 < 1.0.2zn`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.