Quick answers
- Is CVE-2026-83742 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-83742 being exploited in the wild.
- How severe is CVE-2026-83742?
- Informational severity, published 7 October 2026.
- Which products and versions are affected?
- Wolfssl wolfSSH v1.4.11 through v1.5.0 on non-Windows platforms.
- Is there a fix for CVE-2026-83742?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-83742 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-83742?
- Check whether you run Wolfssl wolfSSH at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An unsigned integer underflow in the wstrncat() function in src/port.c occurs when wolfSSH_RealPath() computes remaining buffer size as a size_t value; once the accumulated path reaches half the output buffer, the expression (outSz - curSz) wraps to near SIZE_MAX, causing strncat() to become effectively unbounded and write one null byte past the buffer end. The vulnerability requires authentication and a crafted SFTP path, and results in limited stack corruption (single null byte overflow) that may crash the process.
Affected products
- wolfSSL wolfSSH v1.4.11 through v1.5.0 on non-Windows platforms
Timeline
- 2026-10-07: disclosed