Loading vulnerability…
CVE-2025-69419 is a low-severity memory corruption vulnerability in OpenSSL’s PKCS#12 handling, reachable through the public PKCS12_get_friendlyname() API when processing attacker-controlled PKCS#12 data. The flaw occurs during conversion of a PKCS#12 BMPString friendly name from UTF-16BE to UTF-8. In OPENSSL_uni2utf8(), which performs a two-pass conversion, the helper bmp_to_utf8() incorrectly passes the remaining UTF-16 source byte count as the destination buffer capacity to UTF8_putc() during the second pass. For non-ASCII BMP code points above U+07FF, UTF-8 encoding requires three bytes, but the forwarded capacity may be only two bytes. UTF8_putc() then returns -1, and that negative value is added to the output length without validation, causing the computed length to become negative. A subsequent trailing NUL terminator write is then performed at a negative offset, resulting in a one-byte write before the start of the heap-allocated buffer. The issue affects OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, and 1.1.1. OpenSSL 1.0.2 is not affected. PKCS12_parse() uses a different code path and is noted as not invoking the vulnerable path.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a small standalone local proof-of-concept reproducer for CVE-2025-69419 in OpenSSL, not a weaponized exploit and not part of a larger framework. The repository contains five files: a README describing the bug and expected ASan behavior, a C source file (poc.c) implementing the trigger, and two helper shell scripts (build.sh and run.sh) for compiling and executing against a locally built vulnerable OpenSSL tree. The core logic is in poc.c. It creates a PKCS8 private key info object, wraps it in a PKCS12 safe bag, adds a malicious BMPString friendlyName via PKCS12_add_friendlyname_uni(), and then calls PKCS12_get_friendlyname(). The malicious input is a UTF-16BE/BMPString sequence representing U+0800 (bytes 0x08, 0x00), chosen because it requires a 3-byte UTF-8 encoding. According to the code comments and README, vulnerable OpenSSL versions miscompute destination capacity during conversion, causing UTF8_putc() failure and a subsequent NUL write at offset -1 from the allocated buffer inside OPENSSL_uni2utf8(). The exploit capability is limited to deterministic vulnerability reproduction and crash detection. It is intended as a regression test or sanitizer-assisted reproducer rather than an exploitation chain. There is no network communication, no remote target interaction, no shellcode, and no attempt to achieve code execution. The attack vector is purely local: the operator compiles the PoC against a vulnerable OpenSSL build and runs it on the same system. build.sh compiles poc.c with gcc using AddressSanitizer and UndefinedBehaviorSanitizer, linking against a user-specified OpenSSL build directory. run.sh sets ASAN_OPTIONS, UBSAN_OPTIONS, and LD_LIBRARY_PATH before executing ./poc. The hardcoded local path /home/USER/rpmbuild/BUILD/openssl-3.0.7-asan is the main fingerprintable environment artifact in the repository. Overall, this is a legitimate PoC reproducer for a memory corruption flaw in OpenSSL's PKCS#12 friendlyName handling, suitable for validating whether a given instrumented OpenSSL build is vulnerable or fixed.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
45 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A vulnerability in OpenSSL addressed indirectly through upgraded third-party components in Tenable Security Center.
An OpenSSL vulnerability patched by upgrading to OpenSSL 3.6.1 in IPFire Core Update 200.
Unknown (listed among related OpenSSL CVEs, but not described in the content).
Low-severity OpenSSL out-of-bounds write issue in PKCS#12 'friendlyname' handling, triggered by crafted PKCS#12 inputs.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.