CVE-2026-5460
Use-After-Free in wolfSSL TLS 1.3 PQC Hybrid KeyShare Processing
Publication date: 2026-04-10
Last updated on: 2026-04-29
Assigner: wolfSSL Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wolfssl | wolfssl | to 5.9.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-416 | The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a heap use-after-free issue in wolfSSL's TLS 1.3 post-quantum cryptography (PQC) hybrid KeyShare processing. Specifically, when an error occurs in the function TLSX_KeyShare_ProcessPqcHybridClient(), an inner function frees a KyberKey object. However, the caller then tries to operate on this already-freed object by calling ForceZero(), which writes zero bytes over freed heap memory, leading to potential memory corruption.
How can this vulnerability impact me? :
The use-after-free vulnerability can lead to memory corruption, which may be exploited by attackers to cause crashes, execute arbitrary code, or compromise the security of the TLS 1.3 PQC hybrid key exchange process in wolfSSL. This undermines the confidentiality and integrity of secure communications relying on this library.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should update the wolfSSL library to version 5.9.1 or later, which includes the fix for CVE-2026-5460.
The fix addresses pointer sanity issues in the Post-Quantum Cryptography hybrid KeyShare implementation, preventing memory corruption and security vulnerabilities.
Applying this update will enhance the robustness and security of wolfSSL’s PQC hybrid key exchange mechanism.