High 7.5Published Jan 27, 2026

CVE-2025-69421NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function

Updated under an hour ago (Oct 28, 2026, 11:40 AM ET)

Does this affect you?

It affects OpenSSL and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for OpenSSL

Exploited in the last 30 days

Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer dereference in the PKCS12_item_decrypt_d2i_ex() function. Impact summary: A NULL pointer dereference can trigger a crash which leads to Denial of Service for an application processing PKCS#12 files. The PKCS12_item_decrypt_d2i_ex() function does not check whether the oct parameter is NULL before dereferencing it. When called from PKCS12_unpack_p7encdata() with a malformed PKCS#12 file, this parameter can be NULL, causing a crash. The vulnerability is limited to Denial of Service and cannot be escalated to achieve code execution or memory disclosure. Exploiting this issue requires an attacker to provide a malformed PKCS#12 file to an application that processes it. For that reason the issue was assessed as Low severity according to our Security Policy. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the PKCS#12 implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.

CVSS: 7.5 HIGH (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): CWE-476
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: openssl
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

OpenSSL OpenSSL openssl:openssl (from the name)	from 3.6.0 before 3.6.1; from 3.5.0 before 3.5.5; from 3.4.0 before 3.4.4; from 3.3.0 before 3.3.6; from 3.0.0 before 3.0.19; from 1.1.1 before 1.1.1ze; from 1.0.2 before 1.0.2zn	CNA record
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	all versions	CISA ADP
openssl openssl openssl:openssl	from 1.0.2 before 1.0.2zn; from 1.1.1 through 1.1.1ze; from 3.0.0 before 3.0.19; from 3.3.0 before 3.3.6; from 3.4.0 before 3.4.4; from 3.5.0 before 3.5.5; from 3.6.0 before 3.6.1	NVD

References

References

https://openssl-library.org/news/secadv/20260127.txt	vendor-advisory
https://github.com/openssl/openssl/commit/a2dbc539f0f9cc63832709fa5aa33ad9495eb19c	patch
https://github.com/openssl/openssl/commit/3524a29271f8191b8fd8a5257eb05173982a097b	patch
https://github.com/openssl/openssl/commit/643986985cd1c21221f941129d76fe0c2785aeb3	patch
https://github.com/openssl/openssl/commit/4bbc8d41a72c842ce4077a8a3eccd1109aaf74bd	patch
https://github.com/openssl/openssl/commit/36ecb4960872a4ce04bf6f1e1f4e78d75ec0c0c7	patch
https://cert-portal.siemens.com/productcert/html/ssa-265688.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.