Executive brief
OpenSSL is a widely used security library for encrypting communications and managing digital certificates. A vulnerability in how it handles specific certificate files (PKCS#12) could allow an attacker to crash an application by providing a specially crafted file. This would primarily result in a service outage (Denial of Service) for systems that process these files.
Technical details
A type confusion vulnerability exists in the PKCS#12 parsing logic of OpenSSL. The root cause is an ASN1_TYPE union member being accessed without prior validation of the type, leading to an invalid pointer read. The vulnerability is constrained to a 1-byte address space (0x00 to 0xFF), which typically corresponds to the unmapped zero page on modern operating systems, resulting in a reliable application crash. Exploitation requires a user or application to process a maliciously crafted PKCS#12 file. The issue affects OpenSSL versions 3.6, 3.5, 3.4, 3.3, 3.0, and 1.1.1, but does not affect the FIPS modules as the vulnerable code resides outside the FIPS boundary.
Affected products
- OpenSSL Foundation OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1
Timeline
- 2026-01-27: disclosed
- 2026-01-27: advisory
References
- https://github.com/openssl/openssl/commit/2502e7b7d4c0cf4f972a881641fe09edc67aeec4
- https://github.com/openssl/openssl/commit/572844beca95068394c916626a6d3a490f831a49
- https://github.com/openssl/openssl/commit/7bbca05be55b129651d9df4bdb92becc45002c12
- https://github.com/openssl/openssl/commit/eeee3cbd4d682095ed431052f00403004596373e
- https://github.com/openssl/openssl/commit/ef2fb66ec571564d64d1c74a12e388a2a54d05d2
- https://openssl-library.org/news/secadv/20260127.txt
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html