CVE-2025-69421: NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function
Vulnerability summary
CVE-2025-69421 is a high (CVSS 7.5) NULL Pointer Dereference vulnerability in openssl. EPSS estimates a 0.94% chance of exploitation in the next 30 days, higher than 61.1% of scored vulnerabilities.
Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 26 · Related 22Timeline
- 27-01-2026PublishedVulnerability first disclosed.
- 15-10-2026Last modifiedVulnerability information updated.
Description
Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer dereference in the PKCS12_item_decrypt_d2i_ex() function. Impact summary: A NULL pointer dereference can trigger a crash which leads to Denial of Service for an application processing PKCS#12 files. The PKCS12_item_decrypt_d2i_ex() function does not check whether the oct parameter is NULL before dereferencing it. When called from PKCS12_unpack_p7encdata() with a malformed PKCS#12 file, this parameter can be NULL, causing a crash. The vulnerability is limited to Denial of Service and cannot be escalated to achieve code execution or memory disclosure. Exploiting this issue requires an attacker to provide a malformed PKCS#12 file to an application that processes it. For that reason the issue was assessed as Low severity according to our Security Policy. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the PKCS#12 implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.
CVSS metrics
7 scores · 7 sources · 1 version- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.94%
Chance of exploitation in the next 30 days
Percentile
61%
Versus all other CVEs
30-day change
Decrease -0.01 pp
From 0.96% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard12 products
- eco-dotnet-libssl-1.0All versions (No fix recorded)
- eco-dotnet-libssl-1.0-ld-so-confAll versions (No fix recorded)
- libcrypto3-2.34< 3.6.1-r0
- openssl< 3.6.1-r0
- openssl-3.5< 3.5.5-r0
Ubuntu4 products
- nodejsAll versions (No fix recorded)
- openssl< 1.0.1f-1ubuntu2.27+esm12 | < 1.0.2g-1ubuntu4.20+esm14 | < 1.0.2g-1ubuntu4.fips.4.20.14 | All versions (No fix recorded) | < 1.1.1-1ubuntu2.1~18.04.23+esm7 | < 1.1.1-1ubuntu2.fips.2.1~18.04.23.7 | < 1.1.1f-1ubuntu2.24+esm2 | < 1.1.1f-1ubuntu2.fips.24.2 | < 3.0.2-0ubuntu1.21 | < 3.0.2-0ubuntu1.21+Fips1 | < 3.0.13-0ubuntu3.7 | < 3.5.3-1ubuntu3 | < 3.5.5-1ubuntu1
- openssl-fipsAll versions (No fix recorded) | < 3.0.13-0ubuntu3.12+Fips1
- openssl1.0< 1.0.2n-1ubuntu5.13+esm3
Alpine1 product
- openssl≥ 1.0.2, < 3.0.19-r0 | ≥ 1.0.2, < 3.3.6-r0 | ≥ 1.0.2, < 3.5.5-r0
Debian1 product
- openssl< 3.0.18-1~deb12u2 | < 3.5.4-1~deb13u2 | < 3.5.5-1
Openssl1 product
- openssl≥ 1.1.1, ≤ 1.1.1ze | ≥ 3.6.0, < 3.6.1 | ≥ 3.5.0, < 3.5.5 | ≥ 3.4.0, < 3.4.4 | ≥ 3.3.0, < 3.3.6 | ≥ 3.0.0, < 3.0.19 | ≥ 1.1.1, < 1.1.1ze | ≥ 1.0.2, < 1.0.2zn
Wolfi1 product
- openssl< 3.6.1-r0
6 vendors · 20 products
