VYPR
← All advisories
High severityNVD Advisory· Published Feb 8, 2023· Updated Nov 4, 2025

Invalid pointer dereference in d2i_PKCS7 functions

CVE-2023-0216

Description

An invalid pointer dereference on read can be triggered when an application tries to load malformed PKCS7 data with the d2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKCS7_fp() functions.

The result of the dereference is an application crash which could lead to a denial of service attack. The TLS implementation in OpenSSL does not call this function however third party applications might call these functions on untrusted data.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

An invalid pointer dereference in OpenSSL's d2i_PKCS7 functions allows denial of service via malformed PKCS7 data.

Summary

CVE-2023-0216 is an invalid pointer dereference vulnerability in OpenSSL that occurs when an application attempts to load malformed PKCS7 data using the d2i_PKCS7(), d2i_PKCS7_bio(), or d2i_PKCS7_fp() functions [1][2]. The root cause is improper validation of PKCS7 input, leading to a read from an invalid pointer.

Exploitation

The vulnerability is triggered when an application calls these functions on untrusted PKCS7 data. While OpenSSL's TLS implementation does not use these functions, third-party applications that parse PKCS7 blobs may be affected [3]. An attacker can craft a malicious PKCS7 structure to cause the dereference, resulting in an application crash.

Impact

Successful exploitation leads to a denial of service (DoS) through application termination. The vulnerability does not allow arbitrary code execution, but repeated crashes can disrupt services.

Mitigation

OpenSSL has released patches in version 3.0.8, 1.1.1t, and 1.0.2zg (premium support) [1]. Users should upgrade to these versions. The Gentoo security advisory also recommends updating to OpenSSL 3.0.10 or later [4].

References
  1. https://www.openssl.org/news/secadv/20230207.txt
  2. NVD - CVE-2023-0216
  3. Invalid pointer dereference in `d2i_PKCS7` functions › RustSec Advisory Database
  4. Multiple Vulnerabilities (GLSA 202402-08) — Gentoo security

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
openssl-srccrates.io
>= 300.0.0, < 300.0.12300.0.12

Affected products

43

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

7

News mentions

0

No linked articles in our index yet.