# CVE-2016-6886: MatrixSSL denial of service in pstm_reverse function

Source: https://junglewise.ai/threats/cve-2016-6886-matrixssl-denial-of-service-in-pstm-reverse-function  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-13. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2016-6886 · Severity: high · CVSS 7.5 · Published 2017-01-13

MatrixSSL is a lightweight TLS/SSL library used to secure communications in embedded devices and applications. A vulnerability in how it handles certain cryptographic keys allows a remote attacker to crash the service by sending a specially crafted value during the initial connection handshake. This results in a denial of service, preventing legitimate users from establishing secure connections to the affected device or application.

Technologies: [Matrixssl](https://junglewise.ai/threats/technologies/matrixssl). Vendors: [Matrixssl](https://junglewise.ai/threats/vendors/matrixssl).

## Quick answers

**Is CVE-2016-6886 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2016-6886 being exploited in the wild.

**How severe is CVE-2016-6886?** High severity, with a CVSS score of 7.5, published 13 January 2017.

**Which products and versions are affected?** MatrixSSL MatrixSSL before 3.8.4.

**Is there a fix for CVE-2016-6886?** A patch was published on 2016-08-01: Fixed in MatrixSSL version 3.8.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2016-6886 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2016-6886?** Check whether you run Matrixssl. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A denial of service vulnerability exists in the MatrixSSL bignum library within the pstm_reverse function. The function fails to properly handle zero-sized inputs, leading to an integer underflow of a length variable and a subsequent invalid memory read. This can be triggered remotely during an RSA key exchange if an attacker provides a zero value or a value equal to the key's modulus as the secret key. The resulting crash terminates the process. The issue was addressed in MatrixSSL version 3.8.4.

## Affected products

- MatrixSSL MatrixSSL before 3.8.4

## Timeline

- 2016-07-31: disclosed: Initial public disclosure by Hanno Böck (The Fuzzing Project)
- 2016-08-01: patched: Fixed in MatrixSSL version 3.8.4
- 2017-01-13: advisory: NVD publication date

## References

- [http://www.matrixssl.org/blog/releases/matrixssl_3_8_4](http://www.matrixssl.org/blog/releases/matrixssl_3_8_4)
- [http://www.securityfocus.com/bid/92604](http://www.securityfocus.com/bid/92604)
- [https://blog.fuzzing-project.org/51-Fun-with-Bignums-Crashing-MatrixSSL-and-more.html](https://blog.fuzzing-project.org/51-Fun-with-Bignums-Crashing-MatrixSSL-and-more.html)

## Related threats

- [MatrixSSL cryptographic key recovery via pstm_exptmod miscalculation](https://junglewise.ai/threats/cve-2016-8671-matrixssl-cryptographic-key-recovery-via-pstm-exptmod)
- [MatrixSSL incorrect modular exponentiation in pstm_exptmod](https://junglewise.ai/threats/cve-2016-6887-matrixssl-incorrect-modular-exponentiation-in-pstm-exptmod)
- [MatrixSSL denial of service in pstm_exptmod function](https://junglewise.ai/threats/cve-2016-6885-matrixssl-denial-of-service-in-pstm-exptmod-function)