Listen to this Post
CVE-2025-65494 is a NULL pointer dereference vulnerability in the get_san_or_cn_from_cert() function within src/coap_openssl.c of OISM libcoap version 4.3.5. This function extracts Subject Alternative Names (SAN) or Common Names (CN) from X.509 certificates during TLS/DTLS handshakes. When processing a crafted X.509 certificate, the function calls sk_GENERAL_NAME_value(), an OpenSSL function that returns a pointer to a GENERAL_NAME structure. With a malicious certificate, this function can return NULL, indicating no valid data. The libcoap code fails to validate this return value, directly dereferencing the NULL pointer. This causes a segmentation fault, crashing the application and leading to denial of service. Remote attackers can trigger this by sending the crafted certificate during secure connection setup, disrupting servers or clients using libcoap. The vulnerability arises from insufficient error handling in certificate parsing, assuming sk_GENERAL_NAME_value() always provides a valid pointer. This issue is specific to version 4.3.5 but may affect others if similar code paths exist. The crash is immediate upon dereference, requiring no authentication, making it critical for systems relying on libcoap for CoAP secure communication.
Platform: OISM libcoap
Version: 4.3.5
Vulnerability: NULL pointer dereference
Severity: Critical
Date: 11/24/2025
Prediction: December 2025 patch
What Undercode Say:
Analytics
Showing bash commands and codes related to the blog
Check version: libcoap-config –version
Test certificate: openssl x509 -in crafted.crt -text
Vulnerable code snippet:
GENERAL_NAME name = sk_GENERAL_NAME_value(names, i);
// Missing NULL check before dereference
char data = ASN1_STRING_get0_data(name->d.ia5); // Crashes here
How Exploit:
Send crafted certificate
Protection from this CVE
Update libcoap version
Impact:
Denial of service
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
