Loading vulnerability…
CVE-2025-69419 is a one-byte heap buffer underwrite in OpenSSL PKCS#12 friendly-name conversion. When PKCS12_get_friendlyname() processes an attacker-controlled PKCS#12 BMPString encoded as UTF-16BE and containing a non-ASCII BMP code point above U+07FF, OPENSSL_uni2utf8() can pass an incorrect destination capacity to UTF8_putc() during its second conversion pass. The resulting negative return value is incorporated into the output length without validation, after which the trailing NUL byte is written at a negative offset before the allocated heap buffer. PKCS12_parse() follows a separate code path and is not affected. Vulnerable releases include OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, and 1.1.1; OpenSSL 1.0.2 is not affected. The OpenSSL FIPS modules are outside the affected PKCS#12 implementation boundary.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a small standalone local proof-of-concept reproducer for CVE-2025-69419 in OpenSSL, not a weaponized exploit and not part of a larger framework. The repository contains five files: a README describing the bug and expected ASan behavior, a C source file (poc.c) implementing the trigger, and two helper shell scripts (build.sh and run.sh) for compiling and executing against a locally built vulnerable OpenSSL tree. The core logic is in poc.c. It creates a PKCS8 private key info object, wraps it in a PKCS12 safe bag, adds a malicious BMPString friendlyName via PKCS12_add_friendlyname_uni(), and then calls PKCS12_get_friendlyname(). The malicious input is a UTF-16BE/BMPString sequence representing U+0800 (bytes 0x08, 0x00), chosen because it requires a 3-byte UTF-8 encoding. According to the code comments and README, vulnerable OpenSSL versions miscompute destination capacity during conversion, causing UTF8_putc() failure and a subsequent NUL write at offset -1 from the allocated buffer inside OPENSSL_uni2utf8(). The exploit capability is limited to deterministic vulnerability reproduction and crash detection. It is intended as a regression test or sanitizer-assisted reproducer rather than an exploitation chain. There is no network communication, no remote target interaction, no shellcode, and no attempt to achieve code execution. The attack vector is purely local: the operator compiles the PoC against a vulnerable OpenSSL build and runs it on the same system. build.sh compiles poc.c with gcc using AddressSanitizer and UndefinedBehaviorSanitizer, linking against a user-specified OpenSSL build directory. run.sh sets ASAN_OPTIONS, UBSAN_OPTIONS, and LD_LIBRARY_PATH before executing ./poc. The hardcoded local path /home/USER/rpmbuild/BUILD/openssl-3.0.7-asan is the main fingerprintable environment artifact in the repository. Overall, this is a legitimate PoC reproducer for a memory corruption flaw in OpenSSL's PKCS#12 friendlyName handling, suitable for validating whether a given instrumented OpenSSL build is vulnerable or fixed.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
71 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A network-reachable, high-complexity vulnerability with no authentication requirement that can result in high confidentiality and integrity impact. The referenced AlmaLinux local security-check plugin indicates exploits are available and a patch was published on March 16, 2026.
An Important-severity vulnerability tracked as CVE-2025-69419, addressed by an AlmaLinux 9.6 local security check. The supplied CVSS v3 vector indicates network-reachable exploitation with high confidentiality and integrity impact, no privileges or user interaction required, and high attack complexity.
A network-reachable vulnerability requiring high attack complexity and no privileges or user interaction, with high confidentiality and integrity impact. The supplied record indicates that exploit code is available and that a patch has been published.
A vulnerability addressed by the EulerOS_SA-2026-3535 OpenSSL package update; no technical flaw details are provided.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.