CVE-2025-11187

Stack buffer overflow in PKCS#12 PBMAC1 PBKDF2 keylength (OpenSSL 3.X)

Found this stack buffer overflow like a year ago, turned out to be a duplicate (CVE-2025-11187)

issue occurs in libcrypto's PKCS# PBMAC1 handling when PBKDF2's keylength is attacker-controlled, It causes a write past a fixed stack buffer in (Tried on OpenSSL 3.6.0) pkcs12_gen_mac() (crypto/pkcs12/p12_mutl.c)

Component: libcrypto (PKCS#12 MAC), providers (PBKDF2)

• Versions: OpenSSL 3.x (3.0+), HEAD confirmed
• Impact: DoS (stack overflow)
• Attack Vector: parsing malicious PKCS#12 using PBMAC1 with oversized PBKDF2 keylength

(if you're gonna run the PoC don't forget to change file paths if needed)