Executive brief
wolfSSL is a security library used by applications to handle encrypted communications and digital signatures. A flaw in how it processes certain digital signature messages (PKCS7) could allow an attacker to cause a crash or potentially access small amounts of sensitive memory. This could impact the reliability of services using the library or lead to minor information disclosure.
Technical details
A heap out-of-bounds read (CWE-125) exists in the PKCS7_VerifySignedData() function of wolfSSL. The vulnerability is caused by a missing bounds check within the indefinite-length end-of-content (EOC) verification loop during streaming PKCS7 parsing. An attacker with adjacent network access can provide a crafted PKCS7 message to trigger the OOB read. This can result in a crash (Denial of Service) or the leakage of memory contents. The issue was addressed in wolfSSL version 5.9.1 via a pull request that adds the necessary bounds checks to the streaming parser.
Affected products
- wolfSSL wolfSSL versions up to (excluding) 5.9.1
Timeline
- 2026-03-21: other: Initial fix submitted via GitHub pull request
- 2026-04-02: patched: Fix merged into master branch
- 2026-04-09: advisory: CVE published by wolfSSL
- 2026-04-10: disclosed: NVD publication date