UpHeron
All vulnerabilities

Servers and applications

CVE-2025-69419

Issue summary: Calling PKCS12_get_friendlyname() function on a maliciously crafted PKCS#12 file with a BMPString (UTF-16BE) friendly name containing non-ASCII BMP code point can trigger a one byte write before the allocated buffer. Impact summary: The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service. The OPENSSL_uni2utf8()…

Severity
High 7.4
Published
27 Jan 2026
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
1.1.1ze, 3.0.19, 3.3.6, 3.4.4, 3.5.5, 3.6.1
Sources
NVD

Affected software

SoftwareAffected versions
OpenSSLServers and applications · cpe:a:openssl:openssl
  • From 1.1.1 before 1.1.1ze
  • From 3.0.0 before 3.0.19
  • From 3.3.0 before 3.3.6
  • From 3.4.0 before 3.4.4
  • From 3.5.0 before 3.5.5
  • From 3.6.0 before 3.6.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-69419
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-69419