CVE-2025-69419 – OpenSSL Heap Buffer Overflow Reproducer

Overview

This repository contains a minimal proof-of-concept reproducer for CVE-2025-69419 affecting vulnerable versions of OpenSSL.

The PoC demonstrates the heap out-of-bounds write reported for PKCS12_get_friendlyname() when processing a specially crafted BMPString friendlyName.

The goal of this project is to provide a simple regression test for developers and security researchers.

This PoC does not implement exploitation techniques and is intended solely to reproduce the memory corruption detected by AddressSanitizer.

Tested Version

• OpenSSL 3.0.7 (ASan/UBSan build)

Vulnerability

According to the public advisory, the vulnerability occurs during UTF-16 (BMPString) to UTF-8 conversion inside:

• PKCS12_get_friendlyname()
• OPENSSL_uni2utf8()

A malformed BMPString containing a character requiring a three-byte UTF-8 sequence results in a one-byte heap write before the allocated buffer.

Building

Edit build.sh and set the path to your OpenSSL build.

Then run:

./build.sh

Running

./run.sh

Expected result on a vulnerable ASan build:

ERROR: AddressSanitizer: heap-buffer-overflow
WRITE of size 1

The stack trace should include:

• OPENSSL_uni2utf8
• PKCS12_get_friendlyname

Notes

Without AddressSanitizer the application may continue execution because the corruption consists of a single-byte write immediately before a heap allocation. ASan reliably detects the out-of-bounds access and terminates the process at the point of corruption.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-69419
• OpenSSL Security Advisory