Buffer Overflow in wolfSSL PKCS#7 Decoding

Publication date: 2026-06-25

Last updated on: 2026-06-27

Assigner: wolfSSL Inc.

Description

The PKCS#7 decode path ignores the caller-supplied output buffer size (outputSz), allowing decoded content to be written past the bounds of the provided buffer. This affects wolfSSL 5.9.0 and earlier and was fixed in the 5.9.1 release.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-25

Last Modified

2026-06-27

Generated

2026-07-16

AI Q&A

2026-06-26

EPSS Evaluated

2026-07-14

NVD

CVE-2026-6681

Affected Vendors & Products

Vendor	Product	Version / Range
wolfssl	wolfssl	From 3.10.0 (inc) to 5.9.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-120	The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability occurs in the PKCS#7 decode path of wolfSSL versions 5.9.0 and earlier. The issue is that the function responsible for decoding does not properly respect the size of the output buffer provided by the caller (outputSz). As a result, decoded content can be written beyond the allocated bounds of the buffer, potentially leading to memory corruption.

Impact Analysis

The vulnerability can lead to memory corruption by writing data past the end of the intended buffer. This can cause application instability, crashes, or potentially be exploited by an attacker to execute arbitrary code or cause denial of service, depending on the context in which the vulnerable function is used.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade wolfSSL to version 5.9.1 or later, as the issue was fixed in that release.

Hi! I’m here to help you understand CVE-2026-6681. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70