# CVE-2026-83742: wolfSSL wolfSSH unsigned integer underflow in wstrncat()

Source: https://junglewise.ai/threats/cve-2026-83742-unsigned-integer-underflow-in-wstrncat-in-src-port-c-in-wolfssl  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-07. Updated: 2026-10-07  
License: CC BY 4.0 with a link back

CVE-2026-83742 · Severity: info · Published 2026-10-07

wolfSSL wolfSSH is an SSH library used in embedded systems and applications requiring secure remote access. An authenticated attacker can craft a malicious SFTP path that triggers an integer underflow in the path handling code, writing a single null byte past the end of a stack buffer. This can corrupt adjacent stack values and crash the application, resulting in a denial of service.

Technologies: [Wolfssl wolfSSH](https://junglewise.ai/threats/technologies/wolfssl-wolfssh). Vendors: [Wolfssl](https://junglewise.ai/threats/vendors/wolfssl).

## Quick answers

**Is CVE-2026-83742 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-83742 being exploited in the wild.

**How severe is CVE-2026-83742?** Informational severity, published 7 October 2026.

**Which products and versions are affected?** Wolfssl wolfSSH v1.4.11 through v1.5.0 on non-Windows platforms.

**Is there a fix for CVE-2026-83742?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-83742 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-83742?** Check whether you run Wolfssl wolfSSH at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An unsigned integer underflow in the wstrncat() function in src/port.c occurs when wolfSSH_RealPath() computes remaining buffer size as a size_t value; once the accumulated path reaches half the output buffer, the expression (outSz - curSz) wraps to near SIZE_MAX, causing strncat() to become effectively unbounded and write one null byte past the buffer end. The vulnerability requires authentication and a crafted SFTP path, and results in limited stack corruption (single null byte overflow) that may crash the process.

## Affected products

- wolfSSL wolfSSH v1.4.11 through v1.5.0 on non-Windows platforms

## Timeline

- 2026-10-07: disclosed

## References

- [https://github.com/wolfSSL/wolfssh/commit/513e52b18927a4e3f7cf17ecaf107958e56139de](https://github.com/wolfSSL/wolfssh/commit/513e52b18927a4e3f7cf17ecaf107958e56139de)
- [https://github.com/wolfSSL/wolfssh/commit/822e4464560b467580ea37a2fc03b0988d88b71f](https://github.com/wolfSSL/wolfssh/commit/822e4464560b467580ea37a2fc03b0988d88b71f)

## Related threats

- [wolfSSL wolfSSH Diffie-Hellman group exchange message handling bypass](https://junglewise.ai/threats/cve-2026-84897-src-internal-c-in-wolfssl-wolfssh-through-1-5-0-admits-the-server)
- [wolfSSL wolfSSHd Windows logon token release-of-resource vulnerability](https://junglewise.ai/threats/cve-2026-83540-when-password-or-public-key-authentication-is-used-with-the)
- [wolfSSH forwarded-tcpip channel authorization bypass](https://junglewise.ai/threats/cve-2026-81535-in-wolfssh-through-1-5-0-built-with-enable-fwd-dochannelopen-in)
- [wolfSSH ECDSA curve substitution in host key parsing](https://junglewise.ai/threats/cve-2026-16516-wolfssh-does-not-validate-that-the-ecdsa-curve-identifier-in-a)