EUVD-2026-39480
GHSA-h6gc-rmv2-74g6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects vendor's AT:P and 'theoretical' qualifier; C:L added because heap overread (CWE-125) can expose adjacent memory despite vendor VC:N.
Primary rating from Vendor (wolfSSL).
CVSS VectorVendor: wolfSSL
Lifecycle Timeline
2DescriptionCVE.org
Heap buffer overread in wc_PKCS7_DecodeEnvelopedData when parsing crafted PKCS7 EnvelopedData. This could theoretically be triggered by attacker-supplied data delivered via S/MIME or CMS.
AnalysisAI
Heap buffer overread in wolfSSL's PKCS7 EnvelopedData parser allows network-reachable attackers to trigger a low-impact availability disruption or potential memory disclosure by supplying a crafted S/MIME or CMS message. The root cause is a missing integer-overflow-safe bounds check before XMEMCPY calls in wc_PKCS7_DecodeEnvelopedData, wc_PKCS7_DecodeAuthEnvelopedData, and wc_PKCS7_DecodeEncryptedData - all three paths lacked validation that idx + encryptedContentSz does not exceed the input buffer. No public exploit code has been identified at time of analysis, and wolfSSL's own CVSS 4.0 vector classifies attack requirements as present (AT:P), meaning exploitation is not straightforwardly reliable.
Technical ContextAI
wolfSSL (cpe:2.3:a:wolfssl:wolfssl:*:*:*:*:*:*:*:*) is a lightweight TLS/SSL and cryptographic library targeting embedded and constrained environments. The vulnerability resides in wolfcrypt/src/pkcs7.c within the PKCS#7/CMS (Cryptographic Message Syntax) parsing subsystem, specifically in the EnvelopedData, AuthEnvelopedData, and EncryptedData decode paths. CWE-125 (Out-of-bounds Read) is the root cause class: the code used an attacker-controlled encryptedContentSz value directly in an XMEMCPY without first confirming that idx + encryptedContentSz falls within the bounds of the pkiMsg buffer. The fix introduces WC_SAFE_SUM_WORD32 to perform overflow-safe addition and compare the result against pkiMsgSz before any copy. A secondary fix in wc_PKCS7_BuildSignedAttributes replaces the static cannedAttribsCount with the actual runtime idx counter to avoid a related count mismatch. S/MIME email processing and any CMS-based data pipeline using this library are the primary attack surfaces.
RemediationAI
The upstream fix is available as GitHub PR #10128 at https://github.com/wolfSSL/wolfssl/pull/10128; however, a tagged release version incorporating this fix has not been independently confirmed from the available references - users should monitor https://www.wolfssl.com/docs/security-vulnerabilities/ for an official advisory citing an exact fix version and update to that release when available. As an interim compensating control, applications processing untrusted S/MIME or CMS EnvelopedData should validate the outer message size before invoking wc_PKCS7_DecodeEnvelopedData and reject inputs exceeding a defined maximum - this reduces the attack surface without disabling the feature entirely. If wolfSSL is used exclusively for TLS and not for PKCS7/CMS/S/MIME processing, the affected code paths are not reachable and no immediate action is required. Disabling S/MIME processing at the application layer entirely removes exposure with no cryptographic side effects on TLS sessions.
wolfSSL prior to version 3.12.2 provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange i
A specially crafted x509 certificate can cause a single out of bounds byte overwrite in wolfSSL through 3.10.2 resulting
wolfSSL (formerly CyaSSL) before 3.6.8 allows remote attackers to cause a denial of service (resource consumption or tra
In wolfSSL before 5.5.1, malicious clients can cause a buffer overflow during a TLS 1.3 handshake. Rated high severity (
An issue was discovered in wolfSSL before 5.5.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita
wolfSSL 4.3.0 has mulmod code in wc_ecc_mulmod_ex in ecc.c that does not properly resist timing side-channel attacks. Ra
In wolfSSL 4.1.0 through 4.2.0c, there are missing sanity checks of memory accesses in parsing ASN.1 certificate data wh
An issue was discovered in wolfSSL before 4.5.0, when single precision is not employed. Rated high severity (CVSS 7.0).
wolfSSL before 4.5.0 mishandles TLS 1.3 server data in the WAIT_CERT_CR state, within SanityCheckTls13MsgReceived() in t
wolfSSL (formerly CyaSSL) before 3.6.8 does not properly handle faults associated with the Chinese Remainder Theorem (CR
An issue was discovered in wolfSSL before 5.5.0 (when --enable-session-ticket is used); however, only version 5.3.0 is e
wolfSSL 4.6.x through 4.7.x before 4.8.0 does not produce a failure outcome when the serial number in an OCSP request di
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today