CVE-2026-8507

CVE-2026-8507: Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl have out-of-bounds (OOB) write flaws

Vendor Jonasbn

Product Crypt::OpenSSL::PKCS12

Weakness CWE-787

Published May 17, 2026

Last update May 18, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl have out-of-bounds (OOB) write flaws. When parsing a PKCS12 file, with a >= 1 GiB OCTET STRING (or BIT STRING) attribute on a SAFEBAG, via info() or info_as_hash(), a heap out-of-bounds write would be triggered with remote-code-execution potential (RCE) due to a signed integer overflow in the size calculation passed to Renew().

Key dates

02Disclosure timeline

May 17, 2026 CVE published

May 18, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-8507 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/787.html

Related vulnerabilities

04Related CVE

CVE-2026-8461 Heap out-of-bounds write via odd slice_height in FFmpeg MagicYUV decoder CVE-2026-53461 ImageMagick: Out-of-bounds write in ICON decoder due to incorrect loop CVE-2026-7829 UltraVNC repeater authenticated out-of-bounds write in rule parser via oversized token CVE-2026-11933 Post-authentication use-after-free in server-side JavaScript BSON-to-array conversion CVE-2026-7383 Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion