wolfSSL CVE-2026-7511

Exploitation requires that the target application was compiled with the HAVE_PKCS7 compile-time flag enabled and uses wolfSSL_PKCS7_get0_signers() to determine signer identity for trust or authorization decisions. The attacker must be positioned on the same network segment as the target (AV:A per the CVSS 4.0 vector - not reachable from the open internet without prior access). Passive user interaction is required (UI:P), meaning the application must process the crafted PKCS#7 message during normal operation. Attack complexity is high (AC:H) because the attacker must precisely control the certificate bundle ordering within a valid PKCS#7 envelope and specific prerequisites must be present (AT:P). Exploitation is limited to the integrity dimension only - confidentiality and availability are unaffected. Applications that independently validate the returned signer certificate against a pinned trust store are not vulnerable to the signer confusion outcome even on unpatched wolfSSL builds.

The CVSS 4.0 vector (AV:A/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N) scores 5.9, reflecting a targeted rather than mass-exploitation scenario: the attacker must be on the adjacent network, attack complexity is high due to the required certificate bundle crafting, and specific prerequisites (AT:P) must be present. Integrity impact is high (VI:H) because a successfully exploited forged signature bypasses trust decisions entirely, but there is no confidentiality or availability impact. This CVE does not appear in the CISA KEV catalog, and no EPSS data was provided, making automated widespread exploitation unlikely at this time. No public exploit has been identified. The practical risk is highest in applications where PKCS#7 signer identity drives authorization decisions - code signing pipelines, firmware update validation, or JWT-over-PKCS#7 flows as suggested by the 'Jwt Attack' tag. The AC:H and AT:P constraints mean real-world exploitation is likely targeted and opportunistic, not automated. Key uncertainty: no affected version range is specified beyond the wildcard CPE - the full historical version scope is not independently confirmed from available data.

An attacker on the adjacent network crafts a malicious PKCS#7 signed message that places a legitimate trusted certificate first in the certificate bundle and their own attacker-controlled self-signed certificate second; the attacker's certificate produces the actual digital signature. When the victim application passes this message to wolfSSL's PKCS7_verify, the signature validates (the attacker cert matches the signature), but wolfSSL_PKCS7_get0_signers returns the trusted certificate as the reported signer, causing the application to treat the forged content as originating from the trusted party. No public proof-of-concept has been identified at time of analysis, but the attack is structurally straightforward for anyone with knowledge of PKCS#7 DER encoding.