Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
High

Out-of-bounds write in OpenSSL PKCS12_get_friendlyname() UTF-8 conversion

IdentifiersCVE-2025-69419CWE-787· Out-of-bounds Write

CVE-2025-69419 is a low-severity memory corruption vulnerability in OpenSSL’s PKCS#12 handling, reachable via the public PKCS12_get_friendlyname() API when processing attacker-controlled PKCS#12 files. The flaw occurs during conversion of a PKCS#12 BMPString friendly name from UTF-16BE to UTF-8. In OPENSSL_uni2utf8(), the second-pass emission path uses bmp_to_utf8(), which incorrectly passes the remaining UTF-16 source byte count as the destination buffer capacity to UTF8_putc(). For non-ASCII BMP code points above U+07FF, UTF-8 encoding requires three bytes, but the forwarded capacity may be only two bytes. UTF8_putc() returns -1, that negative value is added to the output length without validation, and the subsequent trailing NUL byte is written at a negative offset. The result is a one-byte write before the start of a heap-allocated buffer. OpenSSL states that PKCS12_parse() uses a different code path and is not affected by this specific issue.

Share:
For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation causes a one-byte out-of-bounds heap write, specifically a zero byte written before the allocated buffer, resulting in memory corruption. The most credible impact described in the advisory is application crash or Denial of Service. While some downstream summaries mention possible arbitrary code execution, the primary source characterizes the primitive as constrained and assesses the issue as Low severity because the attacker can only trigger a single zero-byte write before the buffer, making reliable code execution unlikely.

Mitigation

If you can’t patch tonight, do this now.

Until patched, avoid invoking PKCS12_get_friendlyname() on untrusted PKCS#12 input. Prefer safer parsing paths where feasible; the advisory explicitly notes that PKCS12_parse() follows a different code path that avoids this bug. If untrusted PKCS#12 files must be handled, restrict acceptance to trusted sources, isolate parsing in a sandboxed or low-privilege process, and apply compensating controls such as input validation and operational containment to reduce crash and memory-corruption risk.

Remediation

Patch, then assume compromise.

Upgrade to a fixed OpenSSL release for the affected branch. The issue is fixed in OpenSSL 3.6.1, 3.5.5, 3.4.4, 3.3.6, 3.0.19, and 1.1.1ze. OpenSSL 1.0.2 is not affected. If OpenSSL is consumed through an operating system, appliance, or bundled runtime, apply the corresponding vendor-supplied update that includes the CVE-2025-69419 fix.
PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType
FreebsdFreebsdapplication
OpenSSL Software FoundationOpensslapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.
Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity23

Community discussion across Reddit, Mastodon, and other social sources.