CVE-2026-6679
Received Received - Intake
Heap Buffer Overflow in wolfSSL DTLS 1.3

Publication date: 2026-06-25

Last updated on: 2026-06-25

Assigner: wolfSSL Inc.

Description
A heap buffer overflow could occur in the DTLS 1.3 ACK serialization path before the connecting peer is authenticated. The buffer overflow was due to an integer truncation when computing the length of the ACK record-number list, causing an undersized buffer to be allocated and then overrun. This affects builds using DTLS 1.3 and wolfSSL version 5.9.0 and earlier. A fix was added to the 5.9.1 release.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-25
Last Modified
2026-06-25
Generated
2026-06-26
AI Q&A
2026-06-26
EPSS Evaluated
N/A
NVD
CVE-2026-6679
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
wolfssl wolfssl to 5.9.1 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.
CWE-190 The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
CWE-197 Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a heap buffer overflow that occurs in the DTLS 1.3 ACK serialization path before the connecting peer is authenticated.

The overflow happens because of an integer truncation when calculating the length of the ACK record-number list, which leads to allocating a buffer that is too small and then overrunning it.

It affects wolfSSL versions 5.9.0 and earlier that use DTLS 1.3, and was fixed in version 5.9.1.

Impact Analysis

A heap buffer overflow can lead to serious security issues such as application crashes, data corruption, or potentially arbitrary code execution.

Since this occurs before the connecting peer is authenticated, an attacker could exploit this vulnerability remotely without needing prior access.

The CVSS base score of 8.8 indicates a high severity, meaning the impact on confidentiality, integrity, and availability could be significant.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade wolfSSL to version 5.9.1 or later, as the fix for the heap buffer overflow was added in that release.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-6679. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart