CVE-2025-11931
BaseFortify
Publication date: 2025-11-21
Last updated on: 2025-12-04
Assigner: wolfSSL Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wolfssl | wolfssl | 5.8.4 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-191 | The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an integer underflow that leads to out-of-bounds memory access in the XChaCha20-Poly1305 decryption function wc_XChaCha20Poly1305_Decrypt(). It occurs specifically when this function is called directly by an application, not during TLS connections.
How can this vulnerability impact me? :
The vulnerability could potentially allow an attacker to cause out-of-bounds memory access during decryption, which might lead to crashes or other unintended behavior in the affected application. However, the CVSS score is low (2.1), indicating limited impact and requiring user interaction and network attack vector.