The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer dereference in the PKCS12_item_decrypt_d2i_ex() function.
Impact summary: A NULL pointer dereference can trigger a crash which leads to Denial of Service for an application processing PKCS#12 files.
The PKCS12_item_decrypt_d2i_ex() function does not check whether the oct parameter is NULL before dereferencing it. When called from PKCS12_unpack_p7encdata() with a malformed PKCS#12 file, this parameter can be NULL, causing a crash. The vulnerability is limited to Denial of Service and cannot be escalated to achieve code execution or memory disclosure.
Exploiting this issue requires an attacker to provide a malformed PKCS#12 file to an application that processes it. For that reason the issue was assessed as Low severity according to our Security Policy.
The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the PKCS#12 implementation is outside the OpenSSL FIPS module boundary.
OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade opensslUpgrade openssl-perlUpgrade openssl-libsUpgrade openssl-devel | Feb 3, 2026 | Jan 28, 2026 |
| Alpine Linux | — | Upgrade openssl | Jan 28, 2026 | Jan 27, 2026 |
| Amazon Linux Ami 2 | — | Upgrade openssl-perlUpgrade openssl-snapsafeUpgrade edk2-toolsUpgrade edk2-ovmfUpgrade openssl-libsUpgrade openssl-develUpgrade edk2-aarch64Upgrade openssl-snapsafe-libsUpgrade openssl-debuginfoUpgrade openssl11-debuginfoUpgrade openssl11-staticUpgrade openssl11-libsUpgrade edk2-tools-docUpgrade openssl-staticUpgrade openssl11-develUpgrade openssl-snapsafe-perlUpgrade openssl-snapsafe-debuginfoUpgrade openssl-snapsafe-develUpgrade opensslUpgrade openssl11Upgrade edk2-debuginfoUpgrade openssl-snapsafe-static | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade openssl-libsUpgrade openssl-snapsafe-libs-debuginfoUpgrade openssl-fips-provider-latest-debuginfoUpgrade opensslUpgrade openssl-snapsafe-libsUpgrade openssl-libs-debuginfoUpgrade openssl-perlUpgrade openssl-fips-provider-latestUpgrade openssl-develUpgrade openssl-debugsourceUpgrade openssl-debuginfoUpgrade aws-cfn-bootstrap | Feb 20, 2026 | Jan 27, 2026 |
| Debian | — | Upgrade openssl | Jan 29, 2026 | Jan 29, 2026 |
| Dell Idrac | — | Upgrade Dell iDRAC to the latest version | Apr 29, 2026 | Apr 28, 2026 |
| Freebsd | — | Upgrade FreeBSDUpgrade openssl34Upgrade openssl36Upgrade openssl33Upgrade openssl35Upgrade openssl | Jan 28, 2026 | Jan 27, 2026 |
| Http Openssl | — | Upgrade to the latest version of OpenSSL | Mar 5, 2026 | Jan 27, 2026 |
| Ibm Aix | — | Apply the fix or workaround for openssl_advisory46 | Mar 10, 2026 | Mar 9, 2026 |
| Oracle_linux | — | Upgrade opensslUpgrade openssl-perlUpgrade openssl-develUpgrade openssl-libs | Jan 30, 2026 | Jan 27, 2026 |
| Redhat_linux | — | Upgrade openssl-libsNo solution existsUpgrade openssl-perlUpgrade openssl-develUpgrade openssl-debuginfoUpgrade opensslUpgrade openssl-debugsourceUpgrade openssl-libs-debuginfo | Jan 29, 2026 | Jan 27, 2026 |
| Rocky_linux | — | Upgrade openssl-debuginfoUpgrade openssl-libs-debuginfoUpgrade opensslUpgrade openssl-perlUpgrade openssl-debugsourceUpgrade openssl-develUpgrade openssl-libs | Feb 2, 2026 | Jan 30, 2026 |
| Ubuntu | — | Upgrade libssl1.0.0 (Ubuntu Pro)Upgrade openssl1.0 (Ubuntu Pro)Upgrade openssl (Ubuntu Pro)Upgrade libssl1.1 (Ubuntu Pro)Upgrade opensslUpgrade libssl3t64Upgrade libssl3 | Jan 28, 2026 | Jan 27, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Jan 27, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub