Is CVE-2026-8507 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8507 being exploited in the wild.

How severe is CVE-2026-8507?

Informational severity, with a CVSS score of 9.8, published 17 May 2026.

Which products and versions are affected?

Perl CPAN Crypt::OpenSSL::PKCS12 through 1.94.

Is there a fix for CVE-2026-8507?

A patch was published on 2026-05-17: Fixed in version 1.95 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-8507 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-8507?

Check whether you run Perl CPAN Crypt::OpenSSL::PKCS12 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8507: Perl Crypt::OpenSSL::PKCS12 heap overflow in print_attribute

CVE-2026-8507 · Severity: info · CVSS 9.8 · Published 2026-05-17

A vulnerability in the Crypt::OpenSSL::PKCS12 Perl library could allow an attacker to execute malicious code or crash a system. This library is used to process PKCS#12 files, which typically contain digital certificates and private keys. By providing a specially crafted certificate file, an attacker could exploit a memory handling error to gain unauthorized access or disrupt operations.

Technologies: Perl CPAN Crypt::OpenSSL::PKCS12. Vendors: Perl CPAN.

Quick answers

Is CVE-2026-8507 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8507 being exploited in the wild.
How severe is CVE-2026-8507?: Informational severity, with a CVSS score of 9.8, published 17 May 2026.
Which products and versions are affected?: Perl CPAN Crypt::OpenSSL::PKCS12 through 1.94.
Is there a fix for CVE-2026-8507?: A patch was published on 2026-05-17: Fixed in version 1.95 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-8507 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-8507?: Check whether you run Perl CPAN Crypt::OpenSSL::PKCS12 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An integer overflow vulnerability exists in the print_attribute function within PKCS12.xs. When processing an OCTET STRING or BIT STRING attribute on a SAFEBAG, the library multiplies the attribute length by 4 to allocate a buffer. If the length is >= 1 GiB (0x40000000), the 32-bit integer multiplication overflows to 0, resulting in a near-zero byte allocation via Renew(). Subsequent data copying via get_hex() then writes approximately 3 GiB of data out-of-bounds on the heap. This can be triggered remotely if an application uses info() or info_as_hash() on untrusted PKCS12 files. The issue is fixed in version 1.95 by adding explicit length guards and promoting the calculation to size_t.

Affected products

Perl CPAN Crypt::OpenSSL::PKCS12 through 1.94

Timeline

2026-05-17: disclosed
2026-05-17: patched: Fixed in version 1.95
2026-05-17: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.