Executive brief
wolfSSL is a security library used to encrypt data and verify identities in embedded devices and cloud applications. A technical flaw in how the library handles specific encrypted message formats (PKCS#7) could lead to incorrect data processing during decryption. While the risk is low, it could potentially cause a localized service disruption or application crash under specific conditions.
Technical details
An integer underflow vulnerability exists in the `wc_PKCS7_DecryptOri` function within `wolfcrypt/src/pkcs7.c`. The flaw is triggered when the library processes a PKCS#7 envelope containing specially crafted 'Other Recipient Info' (ORI) fields. This leads to incorrect length calculations during the decryption process. According to the vendor's CVSS 4.0 assessment, the attack requires local access, high complexity, and user interaction, primarily impacting availability. The issue was addressed in the PKCS#7 fixes merged in April 2026 and is fixed in version 5.9.1.
Affected products
- wolfSSL wolfSSL 3.15.5 through 5.9.1
Timeline
- 2026-04-24: patched: Fixes merged into wolfSSL master branch via Pull Request 10203
- 2026-06-25: disclosed: CVE published to NVD