# CVE-2025-11931: Integer Underflow Leads to Out-of-Bounds Access in XChaCha20-Poly1305 Decrypt. This issue is hit specifically with a…

Source: https://junglewise.ai/threats/cve-2025-11931-integer-underflow-leads-to-out-of-bounds-access-in-xchacha20  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-21  
License: CC BY 4.0 with a link back

CVE-2025-11931 · Severity: high · CVSS 8.2 · Published 2025-11-21

Integer Underflow Leads to Out-of-Bounds Access in XChaCha20-Poly1305 Decrypt. This issue is hit specifically with a call to the function wc_XChaCha20Poly1305_Decrypt() which is not used with TLS connections, only from direct calls from an application.

Technologies: [Wolfssl](https://junglewise.ai/threats/technologies/wolfssl). Vendors: [Wolfssl](https://junglewise.ai/threats/vendors/wolfssl).

## Quick answers

**Is CVE-2025-11931 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-11931 being exploited in the wild.

**How severe is CVE-2025-11931?** High severity, with a CVSS score of 8.2, published 21 November 2025.

**Which products and versions are affected?** Wolfssl. The advisory does not name versions.

**Is there a fix for CVE-2025-11931?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-11931?** Check whether you run Wolfssl. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Wolfssl

## Related threats

- [wolfSSL certificate validation bypass in ConfirmNameConstraints()](https://junglewise.ai/threats/cve-2026-95208-an-issue-in-the-confirmnameconstraints-function-wolfcrypt-src-asn)
- [wolfSSL revocation check bypass with OCSP and CRL](https://junglewise.ai/threats/cve-2026-94417-when-an-application-enables-both-ocsp-and-crl-revocation-checking)
- [wolfSSL TLS 1.2 ChangeCipherSpec message ordering bypass](https://junglewise.ai/threats/cve-2026-93304-a-d-tls-1-2-client-can-accept-a-changecipherspec-message-before)
- [wolfSSL MatchTrustedPeer public key validation bypass](https://junglewise.ai/threats/cve-2026-93302-matchtrustedpeer-ignores-the-public-key-used-leading-to-forged-ca)
- [wolfSSL TLS authentication bypass in Raw Public Key handling](https://junglewise.ai/threats/cve-2026-89136-when-using-rpk-raw-public-key-the-client-side-of-a-tls-1-2-1-3)