Junglewise Threat Intelligence

CVE-2026-22795: OpenSSL type confusion in PKCS#12 parsing

CVE-2026-22795 · Severity: medium · CVSS 5.5 · Published 2026-01-27

Technologies: OpenSSL Foundation OpenSSL.

Executive brief

OpenSSL is a widely used security library for encrypting communications and managing digital certificates. A vulnerability in how it handles specific certificate files (PKCS#12) could allow an attacker to crash an application by providing a specially crafted file. This would primarily result in a service outage (Denial of Service) for systems that process these files.

Technical details

A type confusion vulnerability exists in the PKCS#12 parsing logic of OpenSSL. The root cause is an ASN1_TYPE union member being accessed without prior validation of the type, leading to an invalid pointer read. The vulnerability is constrained to a 1-byte address space (0x00 to 0xFF), which typically corresponds to the unmapped zero page on modern operating systems, resulting in a reliable application crash. Exploitation requires a user or application to process a maliciously crafted PKCS#12 file. The issue affects OpenSSL versions 3.6, 3.5, 3.4, 3.3, 3.0, and 1.1.1, but does not affect the FIPS modules as the vulnerable code resides outside the FIPS boundary.

Affected products

  • OpenSSL Foundation OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1

Timeline

  • 2026-01-27: disclosed
  • 2026-01-27: advisory

References