Vulnerability record · CVE-2012-2110 · published 19 April 2012
CVE-2012-2110: OpenSSL ASN.1 DER Parsing Buffer Overflow
OOpenssl · Openssl
The asn1_d2i_read_bio function in OpenSSL mishandles integer data when parsing DER-encoded input, causing a buffer overflow. A remote attacker can trigger memory corruption by supplying crafted DER data, such as an X.509 certificate or RSA public key. The flaw affects OpenSSL before 0.9.8v, 1.0.0 before 1.0.0i, and 1.0.1 before 1.0.1a.
Description
The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in OpenSSL before 0.9.8v, 1.0.0 before 1.0.0i, and 1.0.1 before 1.0.1a does not properly interpret integer data, which allows remote attackers to conduct buffer overflow attacks, and cause a denial of service (memory corruption) or possibly have unspecified other impact, via crafted DER data, as demonstrated by an X.509 certificate or an RSA public key.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
high priorityHigh EPSS percentile and public exploit reference indicate active exploitation risk, though no KEV listing and the age of the CVE reduce urgency for fully patched systems.
What it is
The asn1_d2i_read_bio function in OpenSSL mishandles integer data when parsing DER-encoded input, causing a buffer overflow. A remote attacker can trigger memory corruption by supplying crafted DER data, such as an X.509 certificate or RSA public key. The flaw affects OpenSSL before 0.9.8v, 1.0.0 before 1.0.0i, and 1.0.1 before 1.0.1a.
Impact
An attacker can cause a denial of service through memory corruption and may achieve code execution or other unspecified impact. The CVSS 2.0 vector indicates partial confidentiality, integrity, and availability impact.
Attack surface
The vulnerability is reachable over the network (AV:N) with no authentication (Au:N) and low attack complexity (AC:L). It is triggered by processing crafted DER data, so any service that parses untrusted X.509 certificates or RSA public keys is exposed.
Exploitation
CISA KEV does not list this CVE, but EPSS is 0.47913 (98.8th percentile), indicating high predicted exploitation activity. A public exploit reference is tagged 'Exploit' in the full disclosure archive.
What to do
- Upgrade OpenSSL to 0.9.8v, 1.0.0i, 1.0.1a or later.
- Apply vendor patches from Red Hat, Fedora, openSUSE, and Apple as applicable.
- Restrict or validate untrusted DER input where feasible, especially certificates and public keys.
- Monitor for and block malformed DER payloads at network or application boundaries.
Detection
- Inspect OpenSSL error logs for ASN.1 parsing failures or memory corruption indicators.
- Use network monitoring to detect malformed DER-encoded certificates or RSA public keys.
- Check for crashes or abnormal process termination in services that parse X.509 certificates.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2012-2110 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2012-2110), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
