PT-2026-31720 · Wolfcrypt · Wolfcrypt

Published 2026-04-09 · Updated 2026-04-14 · CVE-2026-5187

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions wolfcrypt (affected versions not specified)

Description Two potential heap out-of-bounds write locations existed in the DecodeObjectId() function within wolfcrypt/src/asn.c. The first issue arises because a bounds check validates only one available slot before writing two OID arc values, potentially causing a 2-byte out-of-bounds write when the output size (outSz) is equal to 1. The second issue occurs when callers pass sizeof(decOid) (64 bytes on 64-bit platforms) instead of the element count MAX OID SZ (32), allowing the function to accept crafted OIDs with 33 or more arcs, leading to a write past the end of the allocated buffer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Heap Based Buffer Overflow

Weakness Enumeration

CWE-787

CWE-122

Related Identifiers

CVE-2026-5187

Affected Products

Wolfcrypt

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-5187 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-5187 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-5187 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-5187 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-5187 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-5187 · Vendor Advisory
• https://github.com/wolfSSL/wolfssl · Note
• https://github.com/wolfSSL/wolfssl/pull/10025 · Note
• https://twitter.com/CVEnew/status/2042340045579796954 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2044077739154497827 · Twitter Post