EUVD-2026-39558
GHSA-p894-8wv9-373j
Severity by source
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear
Local-only vector with high complexity and low privileges required; passive interaction needed; only low availability impact from incorrect length handling causing potential crash.
Primary rating from Vendor (wolfSSL).
CVSS VectorVendor: wolfSSL
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear
Lifecycle Timeline
2DescriptionCVE.org
Integer underflow in wc_PKCS7_DecryptOri when handling crafted Other Recipient Info, leading to incorrect length handling during decryption.
AnalysisAI
Integer underflow in wolfSSL's PKCS#7 ORI decryption path allows a local low-privileged attacker to cause incorrect length computation during EnvelopedData parsing, resulting in low-severity availability impact. Specifically, when the OID embedded inside an implicit [4] CONSTRUCTED Other Recipient Info sequence consumes more bytes than the field's declared length, the word32 subtraction for oriValueSz wraps around to a near-maximal unsigned value, feeding corrupted length data to downstream decryption logic. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local system access with at least low-privilege credentials (AV:L, PR:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 1.0 accurately reflects the highly constrained exploitation surface: local attack vector (AV:L), high complexity (AC:H), presence of a specific attack target required (AT:P), low privileges (PR:L), and passive user interaction (UI:P). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local low-privileged attacker who can supply or influence PKCS#7 EnvelopedData content processed by a wolfSSL-linked application - for example through a file path, local socket, or IPC channel - crafts a message where the OID inside the `[4]` implicit SEQUENCE declares a 20-byte content field but the overall `[4]` length is set to 5, causing the byte consumption to exceed `seqSz` by 17 bytes. When the target application passively processes this input via `wc_PKCS7_DecodeEnvelopedData`, the `word32` subtraction underflows, `oriValueSz` wraps to a near-maximal value, and the resulting incorrect length parameter disrupts decryption logic and may crash the application. … |
| Remediation | The upstream fix is available as GitHub PR #10203 (https://github.com/wolfSSL/wolfssl/pull/10203); however, a tagged patched release version has not been independently confirmed - only the upstream PR reference is available, so this should be treated as 'Upstream fix available (PR/commit); released patched version not independently confirmed.' Organizations should monitor https://www.wolfssl.com/docs/security-vulnerabilities/ for the formal advisory citing a specific release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
wolfSSL prior to version 3.12.2 provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange i
A specially crafted x509 certificate can cause a single out of bounds byte overwrite in wolfSSL through 3.10.2 resulting
wolfSSL (formerly CyaSSL) before 3.6.8 allows remote attackers to cause a denial of service (resource consumption or tra
In wolfSSL before 5.5.1, malicious clients can cause a buffer overflow during a TLS 1.3 handshake. Rated high severity (
An issue was discovered in wolfSSL before 5.5.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita
wolfSSL 4.3.0 has mulmod code in wc_ecc_mulmod_ex in ecc.c that does not properly resist timing side-channel attacks. Ra
In wolfSSL 4.1.0 through 4.2.0c, there are missing sanity checks of memory accesses in parsing ASN.1 certificate data wh
An issue was discovered in wolfSSL before 4.5.0, when single precision is not employed. Rated high severity (CVSS 7.0).
wolfSSL before 4.5.0 mishandles TLS 1.3 server data in the WAIT_CERT_CR state, within SanityCheckTls13MsgReceived() in t
wolfSSL (formerly CyaSSL) before 3.6.8 does not properly handle faults associated with the Chinese Remainder Theorem (CR
An issue was discovered in wolfSSL before 5.5.0 (when --enable-session-ticket is used); however, only version 5.3.0 is e
wolfSSL 4.6.x through 4.7.x before 4.8.0 does not produce a failure outcome when the serial number in an OCSP request di
Same weakness CWE-191 – Integer Underflow
View allSame technique Integer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today