EUVD-2026-21305
GHSA-grqc-3vmg-p68x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessProcess message exceeding 4 GiB threshold
-
DeliveryInteger overflow in totalSz counter
-
ExploitCMAC chain state discarded
-
ExecutionGenerate forged CMAC tag
-
ImpactSubstitute message prefix with identical tag
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires processing messages exceeding 4 GiB (2^28 block flushes) through wolfCrypt CMAC implementation. Attacker can forge CMAC tags for messages sharing common suffixes beyond the 4 GiB threshold. Affects any application using vulnerable wolfCrypt versions for CMAC authentication. |
| Impact | CVSS 8.2 reflects high integrity impact via cryptographic tag forgery on unauthenticated network services. Integer overflow requires 4 GiB message processing-operationally rare but feasible in bulk signing/verification workflows. No KEV or public exploit identified. Priority depends on wolfSSL deployment scale in authentication-critical paths; cryptographic integrity breaches warrant patching despite low exploitation likelihood. |
| Exploit ScenarioDerived | Attacker sends two distinct messages sharing a common suffix beyond 4 GiB processed through wc_CmacUpdate. Due to totalSz integer overflow, the second message's CMAC tag incorrectly matches the first, enabling prefix substitution forgery. Requires network access (AV:N) and no authentication (PR:N); no public exploit code exists. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 10, 2026
Integer overflow in wolfSSL CMAC implementation (versions ≤5.9.0) enables zero-effort cryptographic forgery. The wc_CmacUpdate function uses a 32-bit counter (totalSz) that wraps to zero after processing 4 GiB of data, erroneously discarding live CBC-MAC chain state. Attackers can forge CMAC authentication tags by crafting messages with identical suffixes beyond the 4 GiB boundary, undermining message authentication integrity in unauthenticated network contexts. No public exploit identified at time of analysis.
RemediationAI
Upstream fix available via GitHub pull request https://github.com/wolfSSL/wolfssl/pull/10102; released patched version not independently confirmed at time of analysis. Organizations should monitor wolfSSL release notes for version ≥5.9.1 incorporating PR #10102. Immediate mitigation: disable CMAC-based authentication in wolfSSL configurations if upgrade infeasible; restrict message processing to <4 GiB per CMAC context initialization; implement external message length validation. Long-term: adopt patched wolfSSL build and verify CMAC test vectors post-deployment. Consult official advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-5477 and vendor security bulletins for formal guidance. If CMAC is non-critical, consider alternative HMAC-based authentication modes (e.g., AES-GCM, HMAC-SHA256) until patch deployment completes.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Root cause: word32 totalSz counter in wc_CmacUpdate wraps at 2^32 bytes (4 GiB), causing guard condition if (cmac->totalSz != 0) to re-trigger zero initialization mid-operation. This discards accumulated CBC-MAC state, collapsing distinct message prefixes into identical tags when suffixes align post-wrap. Fix eliminates conditional XOR, relying on zero-initialized digest from wc_InitCmac_ex.
Know when Wolfssl gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
An integer overflow existed in the wolfCrypt CMAC implementation, that could be exploited to forge CMAC tags. The function wc_CmacUpdate used the guard if (cmac->totalSz != 0) to skip XOR-chaining on the first block (where digest is all-zeros and the XOR is a no-op). However, totalSz is word32 and wraps to zero after 2^28 block flushes (4 GiB), causing the guard to erroneously discard the live CBC-MAC chain state. Any two messages sharing a common suffix beyond the 4 GiB mark then produce identical CMAC tags, enabling a zero-work prefix-substitution forgery. The fix removes the guard, making the XOR unconditional; the no-op property on the first block is preserved because digest is zero-initialized by wc_InitCmac_ex.
Executive ViewAI
wolfSSL versions 5.9.0 and earlier contain a critical integer overflow in CMAC authentication that enables attackers to forge cryptographic signatures on messages exceeding 4 GiB, potentially bypassing message authentication controls in applications relying on this library for data integrity verification. Organizations using wolfSSL in cryptographic operations face immediate risk of authentication bypass affecting any system processing large data volumes without compensating controls.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict CMAC operations to messages strictly under 4 GiB in size; (2) Implement dual-layer message authentication using independent cryptographic libraries (e.g., OpenSSL HMAC-SHA256) in parallel with CMAC; (3) Deploy rate-limiting and anomaly detection for authentication failures on large-data transactions; (4) Disable CMAC functionality entirely if alternative authenticated encryption (AES-GCM, ChaCha20-Poly1305) is available in your application architecture. Contact wolfSSL security@wolfssl.com for patch timeline and consider code review of wc_CmacUpdate function in your deployment.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Related Vulnerabilities in wolfSSL Cryptographic and Certificate Verification Flaws
View all 7wolfSSL prior to version 3.12.2 provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange i
A specially crafted x509 certificate can cause a single out of bounds byte overwrite in wolfSSL through 3.10.2 resulting
Authentication bypass in wolfSSL TLS clients built with Raw Public Key (RPK) support allows a malicious or on-path serve
wolfSSL builds that enable the WOLFSSL_TRUST_PEER_CERT macro can be induced to accept a forged clone of a trusted-peer C
Certificate forgery in the wolfSSL client (versions 5.7.2 through 5.9.2) lets a remote attacker who already holds any ce
wolfSSL (formerly CyaSSL) before 3.6.8 allows remote attackers to cause a denial of service (resource consumption or tra
In wolfSSL before 5.5.1, malicious clients can cause a buffer overflow during a TLS 1.3 handshake. Rated high severity (
An issue was discovered in wolfSSL before 5.5.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita
wolfSSL 4.3.0 has mulmod code in wc_ecc_mulmod_ex in ecc.c that does not properly resist timing side-channel attacks. Ra
In wolfSSL 4.1.0 through 4.2.0c, there are missing sanity checks of memory accesses in parsing ASN.1 certificate data wh
An issue was discovered in wolfSSL before 4.5.0, when single precision is not employed. Rated high severity (CVSS 7.0).
wolfSSL before 4.5.0 mishandles TLS 1.3 server data in the WAIT_CERT_CR state, within SanityCheckTls13MsgReceived() in t
Exploit-DB