CVE-2026-22795

/// Technical description

Issue summary: An invalid or NULL pointer dereference can happen in

an application processing a malformed PKCS#12 file.

Impact summary: An application processing a malformed PKCS#12 file can be

caused to dereference an invalid or NULL pointer on memory read, resulting

in a Denial of Service.

A type confusion vulnerability exists in PKCS#12 parsing code where

an ASN1_TYPE union member is accessed without first validating the type,

causing an invalid pointer read.

The location is constrained to a 1-byte address space, meaning any

attempted pointer manipulation can only target addresses between 0x00 and 0xFF.

This range corresponds to the zero page, which is unmapped on most modern

operating systems and will reliably result in a crash, leading only to a

Denial of Service. Exploiting this issue also requires a user or application

to process a maliciously crafted PKCS#12 file. It is uncommon to accept

untrusted PKCS#12 files in applications as they are usually used to store

private keys

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References