Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2026-22795

Опубликовано: 27 янв. 2026
Источник: nvd
CVSS3: 5.5
EPSS Низкий

Описание

Issue summary: An invalid or NULL pointer dereference can happen in an application processing a malformed PKCS#12 file.

Impact summary: An application processing a malformed PKCS#12 file can be caused to dereference an invalid or NULL pointer on memory read, resulting in a Denial of Service.

A type confusion vulnerability exists in PKCS#12 parsing code where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid pointer read.

The location is constrained to a 1-byte address space, meaning any attempted pointer manipulation can only target addresses between 0x00 and 0xFF. This range corresponds to the zero page, which is unmapped on most modern operating systems and will reliably result in a crash, leading only to a Denial of Service. Exploiting this issue also requires a user or application to process a maliciously crafted PKCS#12 file. It is uncommon to accept untrusted PKCS#12 files in applications as they are usually used to store private keys

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*
Версия от 1.1.1 (включая) до 1.1.1ze (исключая)
cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*
Версия от 3.0.0 (включая) до 3.0.19 (исключая)
cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*
Версия от 3.3.0 (включая) до 3.3.6 (исключая)
cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*
Версия от 3.4.0 (включая) до 3.4.4 (исключая)
cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*
Версия от 3.5.0 (включая) до 3.5.5 (исключая)
cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*
Версия от 3.6.0 (включая) до 3.6.1 (исключая)

EPSS

Процентиль: 1%
0.00012
Низкий

5.5 Medium

CVSS3

Дефекты

CWE-754

Связанные уязвимости

CVSS3: 5.5
ubuntu
8 дней назад

Issue summary: An invalid or NULL pointer dereference can happen in an application processing a malformed PKCS#12 file. Impact summary: An application processing a malformed PKCS#12 file can be caused to dereference an invalid or NULL pointer on memory read, resulting in a Denial of Service. A type confusion vulnerability exists in PKCS#12 parsing code where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid pointer read. The location is constrained to a 1-byte address space, meaning any attempted pointer manipulation can only target addresses between 0x00 and 0xFF. This range corresponds to the zero page, which is unmapped on most modern operating systems and will reliably result in a crash, leading only to a Denial of Service. Exploiting this issue also requires a user or application to process a maliciously crafted PKCS#12 file. It is uncommon to accept untrusted PKCS#12 files in applications as they are usually used to store private keys ...

CVSS3: 5.5
debian
8 дней назад

Issue summary: An invalid or NULL pointer dereference can happen in an ...

CVSS3: 5.5
github
8 дней назад

Issue summary: An invalid or NULL pointer dereference can happen in an application processing a malformed PKCS#12 file. Impact summary: An application processing a malformed PKCS#12 file can be caused to dereference an invalid or NULL pointer on memory read, resulting in a Denial of Service. A type confusion vulnerability exists in PKCS#12 parsing code where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid pointer read. The location is constrained to a 1-byte address space, meaning any attempted pointer manipulation can only target addresses between 0x00 and 0xFF. This range corresponds to the zero page, which is unmapped on most modern operating systems and will reliably result in a crash, leading only to a Denial of Service. Exploiting this issue also requires a user or application to process a maliciously crafted PKCS#12 file. It is uncommon to accept untrusted PKCS#12 files in applications as they are usually used to store private ke...

suse-cvrf
3 дня назад

Security update for openssl-1_1

suse-cvrf
3 дня назад

Security update for openssl-1_1

EPSS

Процентиль: 1%
0.00012
Низкий

5.5 Medium

CVSS3

Дефекты

CWE-754