PT-2026-52588 · Wolfssl · Wolfssl

Nicholas Carlini · Publicado 2026-06-25 · Atualizado 2026-06-25 · CVE-2026-6681

NVD

CVSS v4.0

1.0

Baixa

Vetor base

AV:A/AC:L/AT:P/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear

The PKCS#7 decode path ignores the caller-supplied output buffer size (outputSz), allowing decoded content to be written past the bounds of the provided buffer. This affects wolfSSL 5.9.0 and earlier and was fixed in the 5.9.1 release.

Correção

Buffer Overflow

Memory Corruption

Enumeração de Fraquezas

CWE-120

CWE-787

Identificadores relacionados

CVE-2026-6681

Produtos afetados

Wolfssl

Referências · 3

• https://github.com/wolfSSL/wolfssl/pull/10116 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2026-6681 · Nota de Segurança
• https://wolfssl.com/docs/security-vulnerabilities · Nota