Issue summary: An invalid or NULL pointer dereference can happen in an application processing a malformed PKCS#12 file.
Impact summary: An application processing a malformed PKCS#12 file can be caused to dereference an invalid or NULL pointer on memory read, resulting in a Denial of Service.
A type confusion vulnerability exists in PKCS#12 parsing code where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid pointer read.
The location is constrained to a 1-byte address space, meaning any attempted pointer manipulation can only target addresses between 0x00 and 0xFF. This range corresponds to the zero page, which is unmapped on most modern operating systems and will reliably result in a crash, leading only to a Denial of Service. Exploiting this issue also requires a user or application to process a maliciously crafted PKCS#12 file. It is uncommon to accept untrusted PKCS#12 files in applications as they are usually used to store private keys which are trusted by definition. For these reasons, the issue was assessed as Low severity.
The FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the PKCS12 implementation is outside the OpenSSL FIPS module boundary.
OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.
OpenSSL 1.0.2 is not affected by this issue.
{
"cna_assigner": "openssl",
"cwe_ids": [
"CWE-754"
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22795.json"
}{
"extracted_events": [
{
"cpe": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.1.1"
},
{
"fixed": "1.1.1ze"
}
],
"source": "CPE_RANGE"
}
]
}
{
"extracted_events": [
{
"cpe": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.1.1"
},
{
"fixed": "1.1.1ze"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.0.19"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.3.0"
},
{
"fixed": "3.3.6"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.4.0"
},
{
"fixed": "3.4.4"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.5.0"
},
{
"fixed": "3.5.5"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.6.0"
},
{
"fixed": "3.6.1"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "2502e7b7d4c0cf4f972a881641fe09edc67aeec4"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "572844beca95068394c916626a6d3a490f831a49"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "7bbca05be55b129651d9df4bdb92becc45002c12"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "eeee3cbd4d682095ed431052f00403004596373e"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "ef2fb66ec571564d64d1c74a12e388a2a54d05d2"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22795.json"
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"71476756686855470599937379985047700091",
"166895001063044813957862891151407698928",
"278712318572386455087903167506773264569",
"62751701112678304274354497278072631412",
"305528711857785099232457614306160091925"
],
"threshold": 0.9
},
"id": "CVE-2026-22795-09b46f75",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openssl/openssl/commit/7bbca05be55b129651d9df4bdb92becc45002c12",
"target": {
"file": "apps/s_client.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "199855863195958881625652055964543723547",
"length": 48739
},
"id": "CVE-2026-22795-0b6c52aa",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openssl/openssl/commit/ef2fb66ec571564d64d1c74a12e388a2a54d05d2",
"target": {
"file": "apps/s_client.c",
"function": "s_client_main"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "89525939813841793658939652477796738403",
"length": 46133
},
"id": "CVE-2026-22795-135694a1",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openssl/openssl/commit/572844beca95068394c916626a6d3a490f831a49",
"target": {
"file": "apps/s_client.c",
"function": "s_client_main"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "42797208737688127763066522181332281160",
"length": 507
},
"id": "CVE-2026-22795-17161750",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/kzalewski/openssl-1.1.1/commit/9ad69b994ae7c73ba06d9f75efd2625102de814c",
"target": {
"file": "test/ec_internal_test.c",
"function": "setup_tests"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"60877912797987591188065755797983277280",
"251788162060282103686621368991676932733",
"40400787577453108895692359634937979252",
"331144855365863902029291104116453962179",
"88149325502830834177707272741538263698",
"104081780024832426122495621692374432985",
"320309570822310705485919480150939913446"
],
"threshold": 0.9
},
"id": "CVE-2026-22795-1be6bf98",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openssl/openssl/commit/572844beca95068394c916626a6d3a490f831a49",
"target": {
"file": "crypto/pkcs12/p12_kiss.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"60877912797987591188065755797983277280",
"251788162060282103686621368991676932733",
"40400787577453108895692359634937979252",
"331144855365863902029291104116453962179",
"88149325502830834177707272741538263698",
"104081780024832426122495621692374432985",
"320309570822310705485919480150939913446"
],
"threshold": 0.9
},
"id": "CVE-2026-22795-23f9a2c6",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openssl/openssl/commit/7bbca05be55b129651d9df4bdb92becc45002c12",
"target": {
"file": "crypto/pkcs12/p12_kiss.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"60877912797987591188065755797983277280",
"251788162060282103686621368991676932733",
"40400787577453108895692359634937979252",
"331144855365863902029291104116453962179",
"88149325502830834177707272741538263698",
"104081780024832426122495621692374432985",
"320309570822310705485919480150939913446"
],
"threshold": 0.9
},
"id": "CVE-2026-22795-276a6f9a",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openssl/openssl/commit/eeee3cbd4d682095ed431052f00403004596373e",
"target": {
"file": "crypto/pkcs12/p12_kiss.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "137663506870388774154075225648218501066",
"length": 48972
},
"id": "CVE-2026-22795-30c3a1ca",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openssl/openssl/commit/2502e7b7d4c0cf4f972a881641fe09edc67aeec4",
"target": {
"file": "apps/s_client.c",
"function": "s_client_main"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"60877912797987591188065755797983277280",
"251788162060282103686621368991676932733",
"40400787577453108895692359634937979252",
"331144855365863902029291104116453962179",
"88149325502830834177707272741538263698",
"104081780024832426122495621692374432985",
"320309570822310705485919480150939913446"
],
"threshold": 0.9
},
"id": "CVE-2026-22795-3311f579",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openssl/openssl/commit/ef2fb66ec571564d64d1c74a12e388a2a54d05d2",
"target": {
"file": "crypto/pkcs12/p12_kiss.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"230361427007416664995616424352791763469",
"68454496777232705137616949383570055801",
"174227485603324825134703660955423564225",
"306374039697804480350160125378658725435",
"223787537721903344733141597182001711142",
"305852724676774806958748002571762917320",
"61902118637910596077004663207701223681",
"278724473247779637198513168995006009135",
"150804929727413209120953746872414715465",
"166774358343717215765245239236385866693",
"116293081894868411264108492273509366961",
"326496170417124709669304286305887789679",
"278306348133167756990680493182074324125",
"189649085256091224929149730235838635518",
"82945606976757935725900546138315651129",
"136187505923069729147869676886657763243",
"233447734599456461300796481665382809870",
"116930820689846462220149337293161556595",
"153181275943870954612030432229689150702",
"65985025876624501603393736976041980125"
],
"threshold": 0.9
},
"id": "CVE-2026-22795-3349f255",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/kzalewski/openssl-1.1.1/commit/9ad69b994ae7c73ba06d9f75efd2625102de814c",
"target": {
"file": "crypto/bn/bn_gf2m.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"71476756686855470599937379985047700091",
"166895001063044813957862891151407698928",
"278712318572386455087903167506773264569",
"62751701112678304274354497278072631412",
"305528711857785099232457614306160091925"
],
"threshold": 0.9
},
"id": "CVE-2026-22795-3ae22c42",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openssl/openssl/commit/eeee3cbd4d682095ed431052f00403004596373e",
"target": {
"file": "apps/s_client.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "30673062630639656303483208802482655434",
"length": 494
},
"id": "CVE-2026-22795-4f7f516c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/kzalewski/openssl-1.1.1/commit/9ad69b994ae7c73ba06d9f75efd2625102de814c",
"target": {
"file": "crypto/bn/bn_gf2m.c",
"function": "BN_GF2m_poly2arr"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"71476756686855470599937379985047700091",
"166895001063044813957862891151407698928",
"278712318572386455087903167506773264569",
"62751701112678304274354497278072631412",
"305528711857785099232457614306160091925"
],
"threshold": 0.9
},
"id": "CVE-2026-22795-564c849c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openssl/openssl/commit/2502e7b7d4c0cf4f972a881641fe09edc67aeec4",
"target": {
"file": "apps/s_client.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "137663506870388774154075225648218501066",
"length": 48972
},
"id": "CVE-2026-22795-5e98e146",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openssl/openssl/commit/7bbca05be55b129651d9df4bdb92becc45002c12",
"target": {
"file": "apps/s_client.c",
"function": "s_client_main"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"246451924573170111765630526962404097757",
"196617962610438348365718973266564583117",
"284857352021339567897482824767365180593",
"273428943801490059425881941273658322840"
],
"threshold": 0.9
},
"id": "CVE-2026-22795-68a85aee",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openssl/openssl/commit/eeee3cbd4d682095ed431052f00403004596373e",
"target": {
"file": "crypto/pkcs7/pk7_doit.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"60877912797987591188065755797983277280",
"251788162060282103686621368991676932733",
"40400787577453108895692359634937979252",
"331144855365863902029291104116453962179",
"88149325502830834177707272741538263698",
"104081780024832426122495621692374432985",
"320309570822310705485919480150939913446"
],
"threshold": 0.9
},
"id": "CVE-2026-22795-86099db0",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openssl/openssl/commit/2502e7b7d4c0cf4f972a881641fe09edc67aeec4",
"target": {
"file": "crypto/pkcs12/p12_kiss.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"71476756686855470599937379985047700091",
"166895001063044813957862891151407698928",
"278712318572386455087903167506773264569",
"62751701112678304274354497278072631412",
"305528711857785099232457614306160091925"
],
"threshold": 0.9
},
"id": "CVE-2026-22795-8f8ff17b",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openssl/openssl/commit/572844beca95068394c916626a6d3a490f831a49",
"target": {
"file": "apps/s_client.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"71476756686855470599937379985047700091",
"166895001063044813957862891151407698928",
"278712318572386455087903167506773264569",
"62751701112678304274354497278072631412",
"305528711857785099232457614306160091925"
],
"threshold": 0.9
},
"id": "CVE-2026-22795-991d33fa",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openssl/openssl/commit/ef2fb66ec571564d64d1c74a12e388a2a54d05d2",
"target": {
"file": "apps/s_client.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"246451924573170111765630526962404097757",
"196617962610438348365718973266564583117",
"284857352021339567897482824767365180593",
"273428943801490059425881941273658322840"
],
"threshold": 0.9
},
"id": "CVE-2026-22795-af52563c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openssl/openssl/commit/7bbca05be55b129651d9df4bdb92becc45002c12",
"target": {
"file": "crypto/pkcs7/pk7_doit.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"28170854778703993674264004058177114599",
"73132526844288570625317440636111911761",
"177405411499435185068645597737938634778",
"224809958623850711330610094965797758930",
"295554444428855106393106961197201359586"
],
"threshold": 0.9
},
"id": "CVE-2026-22795-c377fa22",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openssl/openssl/commit/e04bd3433fd84e1861bf258ea37928d9845e6a86",
"target": {
"file": "include/openssl/opensslv.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"246451924573170111765630526962404097757",
"196617962610438348365718973266564583117",
"284857352021339567897482824767365180593",
"273428943801490059425881941273658322840"
],
"threshold": 0.9
},
"id": "CVE-2026-22795-d52a9a4d",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openssl/openssl/commit/572844beca95068394c916626a6d3a490f831a49",
"target": {
"file": "crypto/pkcs7/pk7_doit.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"246451924573170111765630526962404097757",
"196617962610438348365718973266564583117",
"284857352021339567897482824767365180593",
"273428943801490059425881941273658322840"
],
"threshold": 0.9
},
"id": "CVE-2026-22795-d6153be7",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openssl/openssl/commit/2502e7b7d4c0cf4f972a881641fe09edc67aeec4",
"target": {
"file": "crypto/pkcs7/pk7_doit.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"246451924573170111765630526962404097757",
"196617962610438348365718973266564583117",
"284857352021339567897482824767365180593",
"273428943801490059425881941273658322840"
],
"threshold": 0.9
},
"id": "CVE-2026-22795-f144311b",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openssl/openssl/commit/ef2fb66ec571564d64d1c74a12e388a2a54d05d2",
"target": {
"file": "crypto/pkcs7/pk7_doit.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"202560716467995180801900703314012126638",
"231076714992210239911677876085986544653",
"119476550149019858610160764241585512883",
"237713134421560846878241190267682686452",
"291912177671523663250360670212314966717",
"148718397703357758449784276736258891876",
"8308956487359903771982894414540058331",
"219665286569007368979236427780197060159"
],
"threshold": 0.9
},
"id": "CVE-2026-22795-f19f6747",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/kzalewski/openssl-1.1.1/commit/9ad69b994ae7c73ba06d9f75efd2625102de814c",
"target": {
"file": "test/ec_internal_test.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"215474658839038190857768659117172798903",
"224789752300883698945153787266757617261",
"56494159630746388130037307952134413004",
"164370382436795402003615230331141913984",
"149153318460680570484795927015804201404"
],
"threshold": 0.9
},
"id": "CVE-2026-22795-fa870959",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/kzalewski/openssl-1.1.1/commit/9ad69b994ae7c73ba06d9f75efd2625102de814c",
"target": {
"file": "include/openssl/opensslv.h"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "127898544240712534256163966369522564864",
"length": 48969
},
"id": "CVE-2026-22795-fbed4a44",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openssl/openssl/commit/eeee3cbd4d682095ed431052f00403004596373e",
"target": {
"file": "apps/s_client.c",
"function": "s_client_main"
}
}
]
"2026-11-12T07:06:26Z"