The vulnerability in Crypt::OpenSSL::PKCS12 (up to version 1.94) arises from improper null termination handling (CWE-170) in the password parameter processing. Passwords passed to PKCS12.xs are declared as char * and converted via Perl's default typemap to SvPV_nolen, which discards the Perl string length. Consequently, the underlying C code or OpenSSL calls strlen() on the password buffer, truncating it at the first NULL byte. This silent truncation reduces password entropy, particularly affecting binary, KDF-derived, or HMAC-derived passwords, potentially weakening cryptographic protections.

This vulnerability can lead to significant security impacts including loss of confidentiality, integrity, and availability of cryptographic material protected by the affected module. Because passwords with embedded NULL bytes are truncated, attackers may exploit this to reduce the effective password strength, potentially enabling unauthorized access or cryptographic key compromise. The CVSS score of 9.8 reflects the critical nature of this issue with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Until a patch is released, users should avoid using passwords containing embedded NULL bytes with Crypt::OpenSSL::PKCS12. Monitoring vendor communications for updates is recommended.