CVE-2026-17510 is a buffer sizing bug in an ASN.1 decoder's BMPSTRING handling path. The function that decodes PKCS#12 attributes has four arms handling different string encodings — UTF8STRING, OCTET STRING, BIT STRING, and BMPSTRING. Three of these allocate buffers with length + 1, reserving space for a null terminator. The BMPSTRING arm uses just length, making an implicit assumption that zero-length input cannot occur. When a zero-length BMPSTRING arrives — which is valid DER encoding — the Perl XS layer's Renew() call with size zero returns NULL. The downstream code then dereferences this NULL, causing a crash.
The immediate fix is adding +1 to match the other arms. Do this. But understand what you're fixing: this is not a typo, it's a symptom of architectural drift. The same function contains multiple buffer sizing conventions (length + 1 and length * 4 + 1), suggesting different authors working from different source material. The BMPSTRING arm was written by someone who didn't apply the defensive pattern seen elsewhere. Auditing only this arm closes one hole; auditing the entire function for consistency closes a family of potential issues.
More importantly, the ASN.1 decoder is not broken. It correctly accepts zero-length BMPSTRING because DER permits it. The failure is that downstream code assumed 'valid ASN.1' means 'non-empty string.' This boundary mismatch — decoder follows the spec, consumer has unstated assumptions — is the actual vulnerability class. Any future code calling strlen() on decoder output for any string type will hit the same failure mode if it hasn't explicitly validated for empty strings. The crash is loud, which makes it discoverable, but the pattern is silent in other contexts.
For defenders: check your PKCS#12 parsing code paths for unvalidated string outputs before passing to C string functions. If you're maintaining an XS module that handles ASN.1, audit every decoder-output-to-native-string conversion for empty-input handling. The CPAN ecosystem's copy-paste culture means this pattern likely exists in other modules from the same era. The one-character patch fixes the crash; the architectural inconsistency is what you should hunt.