CVE-2026-1005
Integer Underflow in wolfSSL Packet Sniffer Causes Remote Buffer Overflow
Publication date: 2026-03-19
Last updated on: 2026-04-29
Assigner: wolfSSL Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wolfssl | wolfssl | to 5.8.4 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-191 | The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-1005 is an integer underflow vulnerability in the wolfSSL packet sniffer (versions up to 5.8.4). It occurs because the code processes malformed TLS packets without properly checking their length before subtracting certain constants related to encryption parameters. This causes the length to wrap around to a very large value, leading to a heap buffer overflow in the AEAD decryption routines. An attacker can exploit this by sending a specially crafted TLS record that is shorter than expected, triggering the overflow and potentially crashing the application.
How can this vulnerability impact me? :
This vulnerability can cause a heap buffer overflow and crash in the wolfSSL packet sniffer component. An unauthenticated attacker can remotely trigger this by sending malformed TLS Application Data records. The impact includes potential denial of service due to crashes and possibly other undefined behavior resulting from the buffer overflow, which could be leveraged for further attacks depending on the context.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should apply the patch that adds the necessary length check to the wolfSSL packet sniffer implementation. This fix prevents the integer underflow and subsequent buffer overflow by validating packet lengths before processing.
Ensure that your wolfSSL version is updated to a version including the fix merged on December 23, 2025, or later. Additionally, verify that the sniffer is enabled and ARIA support is configured as per the tested patch conditions.