EUVD-2026-87924
GHSA-rjf7-5h4x-wj8p
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote TLS peer needs no system privileges (PR:N) but must induce a precise read/shutdown/read timing state (AC:H); impact is a UAF crash, so availability-low only, matching vendor VC:N/VI:N.
Primary rating from Vendor (wolfSSL).
CVSS VectorVendor: wolfSSL
Lifecycle Timeline
1DescriptionCVE.org
In all builds that make use of (D)TLS, including default builds, there is a series of conditional states during the TLS shutdown which could lead to a heap-use-after free. If an application ended up getting a partial wolfSSL_read() which is sometimes caused by a small user buffer passed in, then called wolfSSL_shutdown for a bidirectional close and attempted to wolfSSL_read() again while the peer continues trying to send data during the shutdown it would lead to a state where a potential heap-use-after free happened.
AnalysisAI
Heap use-after-free in wolfSSL's (D)TLS shutdown path can crash or corrupt memory in applications that leave decrypted application data buffered (typically after a wolfSSL_read() with a small user buffer), then call wolfSSL_shutdown() for a bidirectional close, then call wolfSSL_read() again while the peer keeps sending data during shutdown. All builds that use (D)TLS, including default builds, are affected per the vendor's own advisory scope, and the defect was confirmed by wolfSSL in fix PR #10863, which ships a dedicated regression test (test_wolfSSL_shutdown_pending_data_uaf) reproducing the exact sequence. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an application built on wolfSSL (D)TLS that exercises a specific API sequence: a partial wolfSSL_read() (typically because a small user buffer leaves decrypted data buffered in clearOutputBuffer), followed by wolfSSL_shutdown() for a bidirectional close, followed by another wolfSSL_read(), all while the remote peer continues sending data during shutdown so that ProcessReply()->GetInputData()->GrowInputBuffer() reallocates the input buffer. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine memory-safety defect (CWE-416 heap use-after-free) confirmed by wolfSSL themselves via the fix PR #10863, which includes a dedicated regression test (test_wolfSSL_shutdown_pending_data_uaf) reproducing the exact sequence - strong evidence the bug is real and well-understood, not speculative. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the upstream fix for this issue and rebuild: the authoritative patch is wolfSSL PR #10863 (https://github.com/wolfSSL/wolfssl/pull/10863), which adds a guard in wolfSSL_shutdown() that returns WOLFSSL_SHUTDOWN_NOT_DONE when ssl->buffers.clearOutputBuffer.length > 0, refusing to enter ProcessReply() (and thus GrowInputBuffer()) while application data is still buffered. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
wolfSSL prior to version 3.12.2 provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange i
A specially crafted x509 certificate can cause a single out of bounds byte overwrite in wolfSSL through 3.10.2 resulting
Authentication bypass in wolfSSL TLS clients built with Raw Public Key (RPK) support allows a malicious or on-path serve
wolfSSL builds that enable the WOLFSSL_TRUST_PEER_CERT macro can be induced to accept a forged clone of a trusted-peer C
Certificate forgery in the wolfSSL client (versions 5.7.2 through 5.9.2) lets a remote attacker who already holds any ce
wolfSSL (formerly CyaSSL) before 3.6.8 allows remote attackers to cause a denial of service (resource consumption or tra
In wolfSSL before 5.5.1, malicious clients can cause a buffer overflow during a TLS 1.3 handshake. Rated high severity (
An issue was discovered in wolfSSL before 5.5.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita
wolfSSL 4.3.0 has mulmod code in wc_ecc_mulmod_ex in ecc.c that does not properly resist timing side-channel attacks. Ra
In wolfSSL 4.1.0 through 4.2.0c, there are missing sanity checks of memory accesses in parsing ASN.1 certificate data wh
An issue was discovered in wolfSSL before 4.5.0, when single precision is not employed. Rated high severity (CVSS 7.0).
wolfSSL before 4.5.0 mishandles TLS 1.3 server data in the WAIT_CERT_CR state, within SanityCheckTls13MsgReceived() in t
Same weakness CWE-416 – Use After Free
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today