CVE-2026-22795Medium· 5.5▾ SunlitIssue summary: An invalid or NULL pointer dereference can happen in an application processing a malformed PKCS#12 file. Impact summary: An application processing a malformed PKCS#12 file can be caused to dereference an invalid or NULL p…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 30.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the CISA ADP record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.2%
Issue summary: An invalid or NULL pointer dereference can happen in an application processing a malformed PKCS#12 file.
Impact summary: An application processing a malformed PKCS#12 file can be caused to dereference an invalid or NULL pointer on memory read, resulting in a Denial of Service.
A type confusion vulnerability exists in PKCS#12 parsing code where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid pointer read.
The location is constrained to a 1-byte address space, meaning any attempted pointer manipulation can only target addresses between 0x00 and 0xFF. This range corresponds to the zero page, which is unmapped on most modern operating systems and will reliably result in a crash, leading only to a Denial of Service. Exploiting this issue also requires a user or application to process a maliciously crafted PKCS#12 file. It is uncommon to accept untrusted PKCS#12 files in applications as they are usually used to store private keys which are trusted by definition. For these reasons, the issue was assessed as Low severity.
The FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the PKCS12 implementation is outside the OpenSSL FIPS module boundary.
OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.
OpenSSL 1.0.2 is not affected by this issue.
OpenSSL >= 3.6.0 < 3.6.1OpenSSL >= 3.5.0 < 3.5.5OpenSSL >= 3.4.0 < 3.4.4OpenSSL >= 3.3.0 < 3.3.6OpenSSL >= 3.0.0 < 3.0.19OpenSSL >= 1.1.1 < 1.1.1zeRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-22796Medium· 5.3ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function
CVE-2025-69420High· 7.5Missing ASN1_TYPE validation in TS_RESP_verify_response() function
CVE-2025-68160Medium· 4.7Heap out-of-bounds write in BIO_f_linebuffer on short writes
CVE-2025-69419High· 7.4Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion
CVE-2025-69421High· 7.5NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function
CVE-2025-69418Medium· 4.0Unauthenticated/unencrypted trailing bytes with low-level OCB function calls