CVE Intelligence
Analysis AI-assisted

CVE-2026-5264: wolfSSL DTLS 1.3 ACK heap buffer overflow

CVE-2026-5264 is a heap-based buffer overflow (CWE-122) in how wolfSSL processes DTLS 1.3 ACK messages. According to the record, a remote attacker can trigger it with a crafted ACK message, and NVD rates it critical with a base score of 9.8. The record lists no confirmed exploitation and the CVE is not in CISA KEV.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-5264 is a heap-based buffer overflow (CWE-122) in the processing of DTLS 1.3 ACK messages in wolfSSL. According to the record, a remote attacker can trigger it by sending a crafted ACK message.

Impact

  • NVD assigns a base score of 9.8 (critical), with high confidentiality, integrity and availability impact in its vector.
  • A CVSS score of 8.3 is also listed from the CNA, wolfSSL.
  • The SSVC fields record technical impact as total and automatable as yes.

Affected products and versions

Exploitation status

The CVE is not listed in CISA KEV and SSVC exploitation is recorded as none. No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Move wolfSSL builds to 5.9.1 or later, which is the first version outside the affected range.
  • Where an upgrade must wait, review whether DTLS 1.3 is enabled in your deployments and limit exposure of affected services to trusted networks.
  • Confirm the fix against the vendor change in pull request 10076.

Detection guidance

  • Monitor services linked against wolfSSL that handle DTLS traffic for unexpected crashes or memory faults.
  • Inventory wolfSSL versions across systems to identify builds before 5.9.1.

Limitations of the available information

  • The record does not describe the exact conditions that trigger the overflow or the size of the out-of-bounds write.
  • No public proof-of-concept or exploitation report is listed in the sources consulted.
  • The EPSS probability of 0.00593 is a statistical estimate, not evidence of exploitation.
  • The record does not state whether builds without DTLS 1.3 support are affected.

Frequently asked questions

Is CVE-2026-5264 being actively exploited?

The CVE is not listed in CISA KEV and the sources consulted report no confirmed exploitation. The SSVC exploitation field is recorded as none.

Which wolfSSL versions are affected?

The record lists wolfSSL versions before 5.9.1 as affected. The referenced patch is pull request 10076 in the wolfSSL repository.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.