CVE-2026-9265 is a heap out-of-bounds read vulnerability in Crypt::OpenSSL::PKCS12 versions prior to 1.96. The vulnerability arises in the print_attribute() function, which copies a UTF8STRING ASN.1 attribute value into a heap buffer sized exactly to its declared length using strncpy without appending a null terminator. Later, strlen() is called on this non-null-terminated buffer, causing it to read beyond the allocated memory. This results in copying attacker-influenced adjacent heap bytes into a Perl scalar, potentially exposing sensitive memory contents.

This vulnerability allows an attacker to cause out-of-bounds reads on the heap, potentially leaking sensitive memory contents adjacent to the copied UTF8STRING attribute. There is no indication of remote code execution or denial of service from the provided data. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should upgrade to version 1.96 or later once available. Until then, avoid processing untrusted ASN.1 UTF8STRING attributes with vulnerable versions of Crypt::OpenSSL::PKCS12.