CVE-2023-0216 - CVE House
Back to Database
Status published Unknown CVE-2023-0216

Invalid pointer dereference in d2i_PKCS7 functions

Vulnerability Description

An invalid pointer dereference on read can be triggered when an application tries to load malformed PKCS7 data with the d2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKCS7_fp() functions. The result of the dereference is an application crash which could lead to a denial of service attack. The TLS implementation in OpenSSL does not call this function however third party applications might call these functions on untrusted data.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-0216

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Marc Schönefeld
  • Tomáš Mráz

References

More from OpenSSL

View All →
CVE-2025-9232
Out-of-bounds read in HTTP client no_proxy handling
Unknown 0
CVE-2025-9231
Timing side-channel in SM2 algorithm on 64 bit ARM
Unknown 0
CVE-2025-9230
Out-of-bounds read & write in RFC 3211 KEK Unwrap
Unknown 0
CVE-2025-69421
NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function
Unknown 0
CVE-2025-69420
Missing ASN1_TYPE validation in TS_RESP_verify_response() function
Unknown 0

Affected Vendor

Affected Software

OpenSSL
Vulnerable Versions:
3.0.0

Timeline

Official Publish: February 8th, 2023
Last Modified: November 4th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.