EUVD-2026-39546
GHSA-8mfx-6cpc-cr47
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable but AC:H because it needs a malicious/MITM server and an oversized transcript; PR:N/UI:N on the client; impact is a DoS crash (A:H) with incidental uncontrolled heap write (I:L), no confidentiality loss.
Primary rating from Vendor (wolfSSL).
CVSS VectorVendor: wolfSSL
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds write in the Renesas TSIP TLS 1.3 transcript buffer. In tsip_StoreMessage() the capacity check guarding the fixed message bag (MSGBAG_SIZE) sets an error code but fails to return, so execution falls through to an XMEMCPY that writes past the end of the buffer once the accumulated TLS 1.3 handshake transcript exceeds MSGBAG_SIZE (8 KB), corrupting adjacent heap state and potentially causing a remote denial of service crash. The bag is sized to hold a normal handshake, so this is reached only by an unusually large but valid certificate chain, or by a malicious or man-in-the-middle server sending an oversized handshake message to a client that does not strictly verify the chain. This only affects builds using the Renesas TSIP TLS port (WOLFSSL_RENESAS_TSIP_TLS) as a TLS 1.3 client on Renesas MCUs with TSIP hardware enabled, and is rated High within those builds. All other configurations are unaffected.
AnalysisAI
Remote denial of service in wolfSSL's Renesas TSIP TLS 1.3 client port (WOLFSSL_RENESAS_TSIP_TLS on Renesas MCUs with TSIP hardware) arises from an out-of-bounds heap write in tsip_StoreMessage(), where the capacity check guarding the fixed 8 KB message bag sets an error code but omits the return, letting execution fall through to an XMEMCPY that overruns the buffer once the accumulated handshake transcript exceeds 8 KB. A malicious or man-in-the-middle TLS 1.3 server (or an unusually large but legitimate certificate chain) can trigger heap corruption and crash the client. There is no public exploit identified at time of analysis, it is not on CISA KEV, and the upstream fix is available as wolfSSL PR #10705.
Technical ContextAI
The flaw lives in the wolfSSL embedded TLS library's Renesas TSIP (Trusted Secure IP) hardware-crypto port, specifically the TLS 1.3 transcript-hash accumulation path in wolfcrypt/src/port/Renesas/renesas_tsip_sha.c. To compute the TLS 1.3 handshake transcript hash, tsip_StoreMessage() copies each handshake message into a fixed-size 'message bag' (MSGBAG_SIZE = 8 KB) via XMEMCPY. The root cause is CWE-787 (Out-of-bounds Write): the bounds check that detects an over-capacity transcript correctly sets an error code but does not return, so control falls through to the unconditional XMEMCPY and msgIdx/buffIdx updates, writing past bag->buff into adjacent heap state. The PR #10705 fix wraps the copy in an else branch so it executes only when the capacity check passes. Per the CPE (cpe:2.3:a:wolfssl:wolfssl:*) the affected component is the wolfSSL library, but only when built with the TSIP TLS port enabled.
RemediationAI
Apply the upstream fix from wolfSSL PR #10705 (https://github.com/wolfSSL/wolfssl/pull/10705), which adds the missing else branch so the XMEMCPY into the message bag executes only when the capacity check passes; an exact tagged patched release version was not provided in the input, so confirm the target release against the vendor advisory at https://www.wolfssl.com/docs/security-vulnerabilities/ before deploying. As a compensating control where rebuilding firmware is not immediately possible, ensure the TLS 1.3 client strictly verifies the server certificate chain (reject untrusted or abnormally large chains) so that a MITM or malicious server cannot deliver an oversized handshake transcript - the trade-off is that this does not protect against a trusted server presenting a legitimately oversized chain. Where feasible, restricting clients to known, trusted TLS endpoints reduces exposure to malicious-server delivery, at the cost of reduced connectivity flexibility. If the deployment does not actually require the Renesas TSIP TLS port, building without WOLFSSL_RENESAS_TSIP_TLS removes the vulnerable code path entirely.
wolfSSL prior to version 3.12.2 provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange i
A specially crafted x509 certificate can cause a single out of bounds byte overwrite in wolfSSL through 3.10.2 resulting
wolfSSL (formerly CyaSSL) before 3.6.8 allows remote attackers to cause a denial of service (resource consumption or tra
In wolfSSL before 5.5.1, malicious clients can cause a buffer overflow during a TLS 1.3 handshake. Rated high severity (
An issue was discovered in wolfSSL before 5.5.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita
wolfSSL 4.3.0 has mulmod code in wc_ecc_mulmod_ex in ecc.c that does not properly resist timing side-channel attacks. Ra
In wolfSSL 4.1.0 through 4.2.0c, there are missing sanity checks of memory accesses in parsing ASN.1 certificate data wh
An issue was discovered in wolfSSL before 4.5.0, when single precision is not employed. Rated high severity (CVSS 7.0).
wolfSSL before 4.5.0 mishandles TLS 1.3 server data in the WAIT_CERT_CR state, within SanityCheckTls13MsgReceived() in t
wolfSSL (formerly CyaSSL) before 3.6.8 does not properly handle faults associated with the Chinese Remainder Theorem (CR
An issue was discovered in wolfSSL before 5.5.0 (when --enable-session-ticket is used); however, only version 5.3.0 is e
wolfSSL 4.6.x through 4.7.x before 4.8.0 does not produce a failure outcome when the serial number in an OCSP request di
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today