PT-2026-52588 · Wolfssl · Wolfssl

Nicholas Carlini · Published 2026-06-25 · Updated 2026-06-25 · CVE-2026-6681

NVD

CVSS v4.0

1.0

Low

Base vector

AV:A/AC:L/AT:P/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear

The PKCS#7 decode path ignores the caller-supplied output buffer size (outputSz), allowing decoded content to be written past the bounds of the provided buffer. This affects wolfSSL 5.9.0 and earlier and was fixed in the 5.9.1 release.

Fix

Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-120

CWE-787

Related Identifiers

CVE-2026-6681

Affected Products

Wolfssl

References · 3

• https://github.com/wolfSSL/wolfssl/pull/10116 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-6681 · Security Note
• https://wolfssl.com/docs/security-vulnerabilities · Note