Wolfssl EUVD-2026-21240

CVSS 6.3 indicates moderate risk with limited practical impact. The vector AV:N/AC:L/PR:N allows unauthenticated remote triggering, but AT:P (Attack Time: Persistent) signals that exploitation requires sustained or repeated network interactions to reliably corrupt heap state. Impact scores VI:L and VA:L confirm low integrity and availability damage; VC:N, VI:L, VA:L suggest information disclosure and minor availability degradation rather than code execution or full system compromise. EPSS data is not provided, limiting probability assessment. The vulnerability is NOT confirmed in CISA KEV (no active exploitation signal), and no public proof-of-concept is referenced. Compared to heap overflows or write-what-where primitives, this use-after-free is constrained by the ForceZero() operation (limited write patterns-zero bytes only). Real-world risk depends on heap layout predictability and whether an attacker can control KyberKey recycling to leak sensitive data from adjacent heap allocations. For organizations using wolfSSL with TLS 1.3 PQC hybrid ciphers in production, this is a moderate-priority issue requiring timely patching; for others, risk is minimal.

An unauthenticated remote attacker performs a TLS 1.3 handshake with a wolfSSL server configured to support PQC hybrid ciphers. The attacker crafts a malformed ClientKeyShare message containing invalid Kyber key data, triggering the error path in TLSX_KeyShare_ProcessPqcClient_ex(). The error handling immediately frees the KyberKey structure, but the subsequent TLSX_KeyShare_FreeAll() call writes zero bytes over the freed heap memory. By repeating this attack with heap spraying techniques, the attacker may corrupt adjacent heap allocations or trigger information disclosure if the freed memory is recycled for sensitive data structures. The AT:P timing constraint suggests this requires multiple handshake attempts to reliably achieve observable impact.