CVE-2026-5295
Stack Buffer Overflow in wolfSSL PKCS7 ORI Decryption
Publication date: 2026-04-09
Last updated on: 2026-04-29
Assigner: wolfSSL Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wolfssl | wolfssl | to 5.9.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-121 | A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a stack buffer overflow in wolfSSL's PKCS7 implementation, specifically in the wc_PKCS7_DecryptOri() function. When processing a CMS EnvelopedData message that contains an OtherRecipientInfo (ORI) recipient, the function copies an ASN.1-parsed Object Identifier (OID) into a fixed-size 32-byte stack buffer without checking if the OID length exceeds this buffer size. If a crafted message contains an OID longer than 32 bytes, it causes a stack buffer overflow.
Exploitation requires that the wolfSSL library is built with the PKCS7 feature enabled (which is disabled by default) and that the application has registered an ORI decrypt callback.
How can this vulnerability impact me? :
The stack buffer overflow can lead to memory corruption, which may allow an attacker to execute arbitrary code, cause a denial of service (crash), or compromise the security of the affected system.
However, exploitation requires specific conditions: the library must be built with PKCS7 enabled and the application must have registered an ORI decrypt callback, which may limit the exposure.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, ensure that the wolfSSL library is not built with the --enable-pkcs7 option enabled, as this feature is disabled by default.
Additionally, avoid registering an ORI decrypt callback via wc_PKCS7_SetOriDecryptCb() in your application, since exploitation requires this callback to be registered.