CVE-2026-6329 describes a vulnerability in the PKCS#12 MAC verification path where the length used for comparison is attacker-controlled. The verification process compares the computed HMAC with the MAC parsed from the PKCS#12 structure using a length value taken directly from the input, without checking if this length matches the digest length produced by the configured algorithm. This allows acceptance of truncated or zero-length MACs, thereby weakening the integrity protection and potentially allowing an attacker to bypass the MAC verification.

The vulnerability undermines the integrity protection of the PKCS#12 MAC verification by allowing an attacker to supply a manipulated length value that causes the system to accept a mismatched or truncated MAC. This could lead to acceptance of tampered PKCS#12 data without detection, compromising data integrity. There are no known exploits in the wild and no direct evidence of confidentiality or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should be cautious when processing PKCS#12 files from untrusted sources. No specific vendor advisory or patch information is provided at this time.