CVE-2025-69419

/// Technical description

Issue summary: Calling PKCS12_get_friendlyname() function on a maliciously

crafted PKCS#12 file with a BMPString (UTF-16BE) friendly name containing

non-ASCII BMP code point can trigger a one byte write before the allocated

buffer.

Impact summary: The out-of-bounds write can cause a memory corruption

which can have various consequences including a Denial of Service.

The OPENSSL_uni2utf8() function performs a two-pass conversion of a PKCS#12

BMPString (UTF-16BE) to UTF-8. In the second pass, when emitting UTF-8 bytes,

the helper function bmp_to_utf8() incorrectly forwards the remaining UTF-16

source byte count as the destination buffer capacity to UTF8_putc(). For BMP

code points above U+07FF, UTF-8 requires three bytes, but the forwarded

capacity can be just two bytes. UTF8_putc() then returns -1, and this negative

value is added to the output length without validation, causing the

length to become negative. The subsequent trailing NUL byte is then written

at a negative offset, causi

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References