CVE-2026-22795

Vulnerability

Overview

CVE-2026-22795 is a type confusion vulnerability in OpenSSL's PKCS#39;s PKCS#12 parsing code. The root cause is that an ASN1_TYPE union member is accessed without first validating the type validation, leading to an invalid or NULL or invalid pointer dereference on memory read [2]. This occurs when an application processes a malformed PKCS#12 file.

Exploitation

Details

Exploitation

Exploitation requires a user or application to process a maliciously crafted PKCS#12 file [2]. The invalid pointer read is constrained to a 1-byte address space (0x00-0xFF), which corresponds to the zero page. On most modern operating systems, this page is unmapped, causing a reliable crash and denial of service [2]. The attack surface is limited because PKCS#12 files are typically used to store trusted private keys and exchange trusted private keys, making it uncommon to accept untrusted files [2].

Impact

Successful exploitation results in a denial of service due to a crash from the invalid pointer dereference [2]. The vulnerability does not allow arbitrary code execution because the pointer manipulation is confined to the unmapped memory [2].

Mitigation

OpenSSL versions 3.6, 3.5, 3.4, 3.3, 3. 3.0, and 1.1.1 are vulnerable [2]. The FIPS modules in 3.0, and 1.1.1 are vulnerable [2]. The FIPS modules in 3.5, 3.4, 3.3, and 3.4, 3.3, and 3.0 are not affected because PKCS#12 processing is outside the FIPS module boundary [2]. OpenSSL 1.0.2 is not affected [2]. Patches have been released to fix the issue [2]. Siemens has also listed affected products in advisory SSA-265688 [1]. Patches have been released to fix the issue [2]. Siemens has also listed affected products in advisory SSA-265688 [1]. Patches have been released to fix the issue [2]. Patches have been released to fix the issue [2]. Siemens has also listed affected products in advisory SSA-265688 [1].