OpenSSL up to 3.6.0 PKCS#12 File unusual condition

Summaryinfo

A vulnerability classified as problematic has been found in OpenSSL up to 3.6.0. This vulnerability affects unknown code of the component PKCS#12 File Handler. This manipulation causes unusual condition. This vulnerability is tracked as CVE-2026-22795. The attack is possible to be carried out remotely. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in OpenSSL up to 3.6.0. Affected by this vulnerability is some unknown processing of the component PKCS#12 File Handler. The manipulation with an unknown input leads to a unusual condition vulnerability. The CWE definition for the vulnerability is CWE-754. The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product. As an impact it is known to affect availability. The summary by CVE is:

Issue summary: An invalid or NULL pointer dereference can happen in an application processing a malformed PKCS#12 file. Impact summary: An application processing a malformed PKCS#12 file can be caused to dereference an invalid or NULL pointer on memory read, resulting in a Denial of Service. A type confusion vulnerability exists in PKCS#12 parsing code where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid pointer read. The location is constrained to a 1-byte address space, meaning any attempted pointer manipulation can only target addresses between 0x00 and 0xFF. This range corresponds to the zero page, which is unmapped on most modern operating systems and will reliably result in a crash, leading only to a Denial of Service. Exploiting this issue also requires a user or application to process a maliciously crafted PKCS#12 file. It is uncommon to accept untrusted PKCS#12 files in applications as they are usually used to store private keys which are trusted by definition. For these reasons, the issue was assessed as Low severity. The FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the PKCS12 implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue. OpenSSL 1.0.2 is not affected by this issue.

It is possible to read the advisory at openssl-library.org. This vulnerability is known as CVE-2026-22795 since 01/09/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 03/13/2026).

The vulnerability scanner Nessus provides a plugin with the ID 296784 (OpenSSL 3.3.0 < 3.3.6 Multiple Vulnerabilities), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.1.1ze, 3.0.19, 3.3.6, 3.4.4, 3.5.5 or 3.6.1 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (296784), EUVD (EUVD-2026-4815) and CERT Bund (WID-SEC-2026-0234). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Affected

• IBM VIOS
• IBM AIX
• Debian Linux
• Google Cloud Platform
• Amazon Linux 2
• Red Hat Enterprise Linux
• NetApp Data ONTAP
• Ubuntu Linux
• SUSE Linux
• Oracle Linux
• IGEL OS
• SUSE openSUSE
• Fabasoft Cloud
• RESF Rocky Linux
• IBM App Connect Enterprise
• Open Source OpenSSL
• Broadcom Brocade SANnav
• Fortinet FortiPortal
• Meinberg LANTIME
• Red Hat OpenShift
• IBM MQ
• Open Source Camunda
• ABB AC-500

Productinfo

Type

• Network Encryption Software

Name

• OpenSSL

Version

• 1.1.1za
• 1.1.1zb
• 1.1.1zc
• 1.1.1zd
• 3.0
• 3.0.0
• 3.0.1
• 3.0.2
• 3.0.3
• 3.0.4
• 3.0.5
• 3.0.6
• 3.0.7
• 3.0.8
• 3.0.9
• 3.0.10
• 3.0.11
• 3.0.12
• 3.0.13
• 3.0.14
• 3.0.15
• 3.0.16
• 3.0.17
• 3.0.18
• 3.1
• 3.2
• 3.3
• 3.3.0
• 3.3.1
• 3.3.2
• 3.3.3
• 3.3.4
• 3.3.5
• 3.4
• 3.4.0
• 3.4.1
• 3.4.2
• 3.4.3
• 3.5
• 3.5.0
• 3.5.1
• 3.5.2
• 3.5.3
• 3.5.4
• 3.6.0

License

• open-source

Website

• Product: https://www.openssl.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion