{"schema_version":"1","data":[{"id":27132,"advisory_id":"a9a33bbb-23a0-452a-8b1b-aa0f8f574a30","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-69419","source_published_at":"2026-01-27T16:01:24.822+00:00","published_at":"2026-10-25T07:20:28.51248+00:00","extraction_method":"structured","technologies":["core-cve","openssl"],"cve_ids":["CVE-2025-69419"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion","summary":"Issue summary: Calling PKCS12_get_friendlyname() function on a maliciously crafted PKCS#12 file with a BMPString (UTF-16BE) friendly name containing non-ASCII BMP code point can trigger a one byte write before the allocated buffer. Impact summary: The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service. The OPENSSL_uni2utf8() function performs a two-pass conversion of a PKCS#12 BMPString (UTF-16BE) to UTF-8. In the second pass, when emitting UTF-8 bytes, the helper function bmp_to_utf8() incorrectly forwards the remaining UTF-16 source byte count as the destination buffer capacity to UTF8_putc(). For BMP code points above U+07FF, UTF-8 requires three bytes, but the forwarded capacity can be just two bytes. UTF8_putc() then returns -1, and this negative value is added to the output length without validation, causing the length to become negative. The subsequent trailing NUL byte is then written at a negative offset, causing write outside of heap allocated buffer. The vulnerability is reachable via the public PKCS12_get_friendlyname() API when parsing attacker-controlled PKCS#12 files. While PKCS12_parse() uses a different code path that avoids this issue, PKCS12_get_friendlyname() directly invokes the vulnerable function. Exploitation requires an attacker to provide a malicious PKCS#12 file to be parsed by the application and the attacker can just trigger a one zero byte write before the allocated buffer. For that","evidence":"cve:CVE-2025-69419","products":[{"name":{"value":"OpenSSL","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-69419","aliases":["CVE-2025-69419"],"metrics":[{"other":{"type":"https://openssl-library.org/policies/general/security-policy/","content":{"text":"Low"}},"format":"other"}],"affected":[{"vendor":"OpenSSL","product":"OpenSSL","versions":[{"status":"affected","version":"3.6.0","lessThan":"3.6.1","versionType":"semver"},{"status":"affected","version":"3.5.0","lessThan":"3.5.5","versionType":"semver"},{"status":"affected","version":"3.4.0","lessThan":"3.4.4","versionType":"semver"},{"status":"affected","version":"3.3.0","lessThan":"3.3.6","versionType":"semver"},{"status":"affected","version":"3.0.0","lessThan":"3.0.19","versionType":"semver"},{"status":"affected","version":"1.1.1","lessThan":"1.1.1ze","versionType":"custom"}],"defaultStatus":"unaffected"}],"modified":"2026-10-15T01:10:26.835Z","provider":"cve","references":["https://openssl-library.org/news/secadv/20260127.txt","https://github.com/openssl/openssl/commit/7e9cac9832e4705b91987c2474ed06a37a93cecb","https://github.com/openssl/openssl/commit/ff628933755075446bca8307e8417c14d164b535","https://github.com/openssl/openssl/commit/cda12de3bc0e333ea8d2c6fd15001dbdaf280015","https://github.com/openssl/openssl/commit/a26a90d38edec3748566129d824e664b54bee2e2","https://github.com/openssl/openssl/commit/41be0f216404f14457bbf3b9cc488dba60b49296"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.4,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2025-69419","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-01-29T15:09:04.605559Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-01-29T15:09:39.154Z"}},{"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","versions":[{"status":"affected","version":"0","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown"}],"x_adpType":"supplier","references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-265688.html"}],"providerMetadata":{"orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","shortName":"siemens-SADP","dateUpdated":"2026-10-15T01:10:26.835Z"}}],"cna":{"orgId":"3a12439a-ef3a-4c79-92e6-6081a721f1e5","shortName":"openssl","dateUpdated":"2026-01-27T16:01:24.822Z"}}},"related_cves":[{"value":"CVE-2025-69419","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null}}],"next_after":27132,"next_before":27132}