--- cve: "CVE-2026-34181" severity: "HIGH" cvss: 7.4 epss: "24%" vendor: "OpenSSL" kev: false exploited: false published: "2026-06-09 17:17:04" tags: [cve, security, high] source: tsecurity.de CVE-Dossier exported: "2026-09-08T22:46:35+02:00" --- # CVE-2026-34181 > 7.4 HIGH · 🧪 PoC ## Beschreibung Issue Summary: The PKCS#12 file processing fails to perform sufficient input validation for files that use Password-Based Message Authentication Code 1 (PBMAC1) integrity mechanism allowing a certificate and private key forgery. Impact Summary: An attacker impersonating a user can cause a service reading PKCS#12 files to accept forged certificates and private keys with a 1 in 256 probability. If a service accepting PKCS#12 files is using passwords for authenticating the received files, the attacker can create unencrypted PKCS#12 files that use PBMAC1 authentication that specifies an HMAC key of only one byte, allowing them to craft a file that will be accepted with a 1 in 256 probability. That would then cause the service to accept a certificate and private key controlled by the attacker. The FIPS modules are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary. ## CVSS-Vektor ``` CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N ``` | Metrik | Wert | Bewertung | |---|---|---| | AV Angriffsvektor | Netzwerk | bad | | AC Komplexität | Hoch | good | | PR Privilegien | Keine | bad | | UI Interaktion | Keine | bad | | S Scope | Unverändert | good | | C Vertraulichkeit | Hoch | bad | | I Integrität | Hoch | bad | | A Verfügbarkeit | Keine | good | ## Patch verfügbar (OSV) - c5ea1cc227fd60afae8ac4b9438690bbe4888f79 (Commit) - 8cf17aaeb4599f8af87fefd810b5b5fee90fe69e (Commit) ## Referenzen - - - - - --- _Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-34181) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_