CVE-2026-8507 Details
Description
Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl have out-of-bounds (OOB) write flaws. When parsing a PKCS12 file, with a >= 1 GiB OCTET STRING (or BIT STRING) attribute on a SAFEBAG, via info() or info_as_hash(), a heap out-of-bounds write would be triggered with remote-code-execution potential (RCE) due to a signed integer overflow in the size calculation passed to Renew().
A heap out-of-bounds write vulnerability has been identified in Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl. This vulnerability occurs when the library parses a PKCS12 file containing a SAFEBAG attribute with an oversized OCTET STRING or BIT STRING. The flaw can be triggered using the 'info()' or 'info_as_hash()' methods', potentially leading to remote code execution.
Users are advised to update to Crypt::OpenSSL::PKCS12 version 1.95, which addresses the vulnerability by adding proper length checks and preventing the integer overflow that led to the out-of-bounds write.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 17, 2026CISA-ADP
Assessed May 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/dsully/perl-crypt-openssl-pkcs12/commit/b9d0469c6d8f5b5c6c2a45a3d0647a532b749397.patch | CPANSec | Source CodeVendor |
| https://github.com/dsully/perl-crypt-openssl-pkcs12/issues/55 | CPANSec | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/dsully/perl-crypt-openssl-pkcs12/issues/56 | CPANSec | ExploitIssue TrackingTechnical DescriptionVendor |
| https://metacpan.org/release/JONASBN/Crypt-OpenSSL-PKCS12-1.95/view/Changes.md | CPANSec | Release NotesVendor |
| http://www.openwall.com/lists/oss-security/2026/05/17/5 | CVE |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| Crypt::OpenSSL::PKCS12 | <= 1.94 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | CPANSec |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 18, 2026 | CVE Modified | CISA-ADP |
| May 18, 2026 | CVE Modified | CPANSec |
| May 17, 2026 | CVE Modified | CVE |
| May 17, 2026 | New CVE Received | CPANSec |