PT-2026-26312 · Wolfssl · Wolfssl

Maor Caplan · Published 2026-03-19 · Updated 2026-03-19 · CVE-2026-0819

NVD

CVSS v4.0

2.2

Low

AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

A stack buffer overflow vulnerability exists in wolfSSL's PKCS7 SignedData encoding functionality. In wc PKCS7 BuildSignedAttributes(), when adding custom signed attributes, the code passes an incorrect capacity value (esd->signedAttribsCount) to EncodeAttributes() instead of the remaining available space in the fixed-size signedAttribs[7] array. When an application sets pkcs7->signedAttribsSz to a value greater than MAX SIGNED ATTRIBS SZ (default 7) minus the number of default attributes already added, EncodeAttributes() writes beyond the array bounds, causing stack memory corruption. In WOLFSSL SMALL STACK builds, this becomes heap corruption. Exploitation requires an application that allows untrusted input to control the signedAttribs array size when calling wc PKCS7 EncodeSignedData() or related signing functions.

Fix

Memory Corruption

Stack Overflow

Weakness Enumeration

CWE-787

CWE-121

Related Identifiers

CVE-2026-0819

Affected Products

Wolfssl

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-0819 · Security Note
• https://github.com/wolfSSL/wolfssl/pull/9630 · Note