The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer dereference in the PKCS12_item_decrypt_d2i_ex() function.
Impact summary: A NULL pointer dereference can trigger a crash which leads to Denial of Service for an application processing PKCS#12 files.
The PKCS12_item_decrypt_d2i_ex() function does not check whether the oct parameter is NULL before dereferencing it. When called from PKCS12_unpack_p7encdata() with a malformed PKCS#12 file, this parameter can be NULL, causing a crash. The vulnerability is limited to Denial of Service and cannot be escalated to achieve code execution or memory disclosure.
Exploiting this issue requires an attacker to provide a malformed PKCS#12 file to an application that processes it. For that reason the issue was assessed as Low severity according to our Security Policy.
The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the PKCS#12 implementation is outside the OpenSSL FIPS module boundary.
OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade openssl-perlUpgrade opensslUpgrade openssl-develUpgrade openssl-libs | Feb 3, 2026 | Jan 28, 2026 |
| Alpine Linux | — | Upgrade openssl | Jan 28, 2026 | Jan 27, 2026 |
| Amazon Linux Ami 2 | — | Upgrade openssl11Upgrade openssl-snapsafe-develUpgrade edk2-tools-docUpgrade opensslUpgrade edk2-debuginfoUpgrade openssl-snapsafe-debuginfoUpgrade openssl-snapsafe-perlUpgrade openssl11-libsUpgrade openssl-staticUpgrade openssl11-develUpgrade openssl-snapsafe-staticUpgrade edk2-toolsUpgrade openssl-develUpgrade edk2-aarch64Upgrade openssl11-staticUpgrade openssl-snapsafe-libsUpgrade openssl-perlUpgrade openssl-snapsafeUpgrade openssl11-debuginfoUpgrade openssl-libsUpgrade openssl-debuginfoUpgrade edk2-ovmf | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade openssl-fips-provider-latest-debuginfoUpgrade openssl-libs-debuginfoUpgrade openssl-perlUpgrade openssl-snapsafe-libs-debuginfoUpgrade opensslUpgrade openssl-snapsafe-libsUpgrade openssl-libsUpgrade openssl-fips-provider-latestUpgrade openssl-develUpgrade aws-cfn-bootstrapUpgrade openssl-debuginfoUpgrade openssl-debugsource | Feb 20, 2026 | Jan 27, 2026 |
| Debian | — | Upgrade openssl | Jan 29, 2026 | Jan 29, 2026 |
| Dell Idrac | — | Upgrade Dell iDRAC to the latest version | Apr 29, 2026 | Apr 28, 2026 |
| Freebsd | — | Upgrade openssl35Upgrade openssl34Upgrade openssl33Upgrade FreeBSDUpgrade openssl36Upgrade openssl | Jan 28, 2026 | Jan 27, 2026 |
| Http Openssl | — | Upgrade to the latest version of OpenSSL | Mar 5, 2026 | Jan 27, 2026 |
| Ibm Aix | — | Apply the fix or workaround for openssl_advisory46 | Mar 10, 2026 | Mar 9, 2026 |
| Oracle_linux | — | Upgrade openssl-perlUpgrade opensslUpgrade openssl-develUpgrade openssl-libs | Jan 30, 2026 | Jan 27, 2026 |
| Redhat_linux | — | Upgrade openssl-develUpgrade openssl-perlUpgrade openssl-libsNo solution existsUpgrade opensslUpgrade openssl-libs-debuginfoUpgrade openssl-debuginfoUpgrade openssl-debugsource | Jan 29, 2026 | Jan 27, 2026 |
| Rocky_linux | — | Upgrade openssl-debuginfoUpgrade opensslUpgrade openssl-perlUpgrade openssl-libs-debuginfoUpgrade openssl-debugsourceUpgrade openssl-develUpgrade openssl-libs | Feb 2, 2026 | Jan 30, 2026 |
| Ubuntu | — | Upgrade libssl3Upgrade libssl3t64Upgrade opensslUpgrade openssl (Ubuntu Pro)Upgrade libssl1.0.0 (Ubuntu Pro)Upgrade openssl1.0 (Ubuntu Pro)Upgrade libssl1.1 (Ubuntu Pro) | Jan 28, 2026 | Jan 27, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Jan 27, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub