Crypt::OpenSSL::PKCS12 versions prior to 1.96 contain a heap out-of-bounds read vulnerability in the print_attribute UTF8STRING path. The function copies an ASN.1 UTF8STRING attribute value into a heap buffer sized exactly to the declared length using strncpy, but does not append a null terminator. Subsequent calls to strlen() on this non-null-terminated buffer cause it to read beyond the allocated memory, passing an inflated length to newSVpvn(). This leads to copying of adjacent heap bytes influenced by an attacker into a Perl scalar, resulting in a heap out-of-bounds read (CWE-125). The vulnerability has a CVSS 3.1 score of 9.1, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality and availability impact.

Successful exploitation allows an attacker to read adjacent heap memory beyond the intended buffer, potentially disclosing sensitive information and causing denial of service due to memory corruption or application instability. The vulnerability does not directly impact integrity but can severely affect confidentiality and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation is currently documented. Users should monitor the vendor's communications for patches or updates addressing this vulnerability before upgrading to version 1.96 or later.