CVE-2026-17510: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-17510 is a NULL pointer dereference vulnerability in the Crypt::OpenSSL::PKCS12 Perl module affecting all versions before 1.98. The flaw exists in the print_attribute() function and can be triggered by a crafted PKCS#12 file containing a zero-length BMPSTRING bag attribute, causing a process crash (SIGSEGV) when info_as_hash() is called. It was disclosed on August 9, 2026, with a patch released in version 1.98. The CVSS category is estimated as Medium, and the CWE classification is CWE-476 (NULL Pointer Dereference) (GitHub Advisory, ENISA EUVD).

The root cause (CWE-476) lies in print_attribute() within PKCS12.xs, where the BMPSTRING branch sizes a destination buffer using Renew(*attribute, length, char). When length is zero, Perl's safesysrealloc treats a zero-size reallocation as a free-and-return-NULL, leaving the buffer pointer NULL. The subsequent strncpy writes nothing, but the downstream caller passes the NULL pointer to strlen() inside newSVpvn(), causing a deterministic SIGSEGV. A zero-length BMPSTRING is syntactically valid per ASN.1 rules (even-length requirement is satisfied), so the ASN.1 decoder accepts it and the malformed value reaches the vulnerable code path. The info() function is unaffected because it passes a NULL hash, bypassing the Renew branch entirely; only info_as_hash() is vulnerable (Commit Patch, GitHub Advisory).

Successful exploitation results in a deterministic process crash (SIGSEGV/denial of service) in any application that passes an untrusted PKCS#12 file to info_as_hash(). No heap bytes adjacent to the NULL pointer are disclosed, so there is no known confidentiality or integrity impact — the vulnerability is strictly a denial-of-service issue. Applications performing certificate management, TLS provisioning, or PKCS#12 import operations using this module are at risk of being crashed by a maliciously crafted input file (GitHub Advisory, ENISA EUVD).

No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation as of the disclosure date. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires only the ability to supply a crafted PKCS#12 file to an application calling info_as_hash(), making it accessible to unauthenticated attackers in scenarios where PKCS#12 file upload or processing is exposed (GitHub Advisory, ENISA EUVD).

1. Craft a malicious PKCS#12 file: Create a PKCS#12 file containing a certBag with a bag attribute set to a zero-length ASN.1 BMPSTRING (e.g., using OpenSSL's X509_ATTRIBUTE_set1_data(attr, V_ASN1_BMPSTRING, "", 0) and packing via PKCS12_pack_p7data/PKCS12_add_safes). A reference fixture (bmpstring-empty.p12) is included in the patch commit.
2. Identify a target application: Locate a Perl application using Crypt::OpenSSL::PKCS12 versions before 1.98 that accepts PKCS#12 file input from untrusted sources and calls info_as_hash() on it.
3. Submit the crafted file: Supply the malicious PKCS#12 file to the target application through any available input vector (file upload, API endpoint, certificate import interface, etc.).
4. Trigger the crash: When the application calls info_as_hash() on the crafted file, print_attribute() processes the zero-length BMPSTRING, Renew(*attribute, 0, char) frees the buffer and returns NULL, and the subsequent strlen(NULL) inside newSVpvn() causes a SIGSEGV, crashing the process (Commit Patch, GitHub Advisory).

• Process: Unexpected SIGSEGV (signal 11) or exit status 139 from Perl processes handling PKCS#12 files; crash dumps referencing print_attribute, newSVpvn, or strlen in stack traces from PKCS12.xs.
• Logs: Application error logs showing segmentation faults or abnormal termination during PKCS#12 parsing or certificate import operations; repeated process restarts by a supervisor (e.g., systemd, Supervisor) correlating with PKCS#12 file submissions.
• File System: Presence of crafted PKCS#12 files with zero-length BMPSTRING bag attributes in upload directories or temporary processing folders; core dump files generated by the Perl process in the working directory.
• Network: Repeated submission of PKCS#12 files to an application endpoint followed by service unavailability or 5xx errors, potentially indicating crash-loop exploitation attempts.

Upgrade Crypt::OpenSSL::PKCS12 to version 1.98 or later, which fixes the NULL pointer dereference by sizing the buffer on strlen(value) + 1 instead of the raw length field, and adds a NULL check on the OPENSSL_uni2asc return value. If immediate patching is not possible, validate and reject PKCS#12 files containing zero-length BMPSTRING attributes before passing them to info_as_hash(), or restrict the processing of PKCS#12 files to trusted sources only. The fix is available via CPAN and the upstream repository (Commit Patch, MetaCPAN).

The vulnerability was assigned by CPANSec and disclosed via the oss-security mailing list on August 9, 2026. Community reaction has been limited given the narrow scope (Perl PKCS#12 processing) and the availability of a patch at the time of disclosure. No notable researcher commentary or significant media coverage has been identified beyond standard vulnerability database aggregation.