Junglewise Threat Intelligence

CVE-2026-5392: wolfSSL heap out-of-bounds read in PKCS7 parsing

CVE-2026-5392 · Severity: medium · CVSS 5.4 · Published 2026-04-10

Technologies: Wolfssl. Vendors: Wolfssl.

Executive brief

wolfSSL is a security library used by applications to handle encrypted communications and digital signatures. A flaw in how it processes certain digital signature messages (PKCS7) could allow an attacker to cause a crash or potentially access small amounts of sensitive memory. This could impact the reliability of services using the library or lead to minor information disclosure.

Technical details

A heap out-of-bounds read (CWE-125) exists in the PKCS7_VerifySignedData() function of wolfSSL. The vulnerability is caused by a missing bounds check within the indefinite-length end-of-content (EOC) verification loop during streaming PKCS7 parsing. An attacker with adjacent network access can provide a crafted PKCS7 message to trigger the OOB read. This can result in a crash (Denial of Service) or the leakage of memory contents. The issue was addressed in wolfSSL version 5.9.1 via a pull request that adds the necessary bounds checks to the streaming parser.

Affected products

  • wolfSSL wolfSSL versions up to (excluding) 5.9.1

Timeline

  • 2026-03-21: other: Initial fix submitted via GitHub pull request
  • 2026-04-02: patched: Fix merged into master branch
  • 2026-04-09: advisory: CVE published by wolfSSL
  • 2026-04-10: disclosed: NVD publication date

References

Related threats