CVE Intelligence
Analysis AI-assisted

CVE-2026-6094: wolfSSL: heap out-of-bounds read in PKCS7 EnvelopedData parsing

CVE-2026-6094 is a heap buffer overread in the wc_PKCS7_DecodeEnvelopedData routine of wolfSSL when it parses crafted PKCS7 EnvelopedData. The record states that this could theoretically be triggered by attacker-supplied data delivered via S/MIME or CMS. NVD scores it 9.1 under CVSS 3.1, while the CNA lists 6.3 under CVSS 4.0, and no KEV listing or confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-6094 affects wolfSSL and is described as a heap buffer overread in wc_PKCS7_DecodeEnvelopedData, the routine that parses PKCS7 EnvelopedData. The CNA mapping is CWE-125 (Out-of-bounds Read). The record was published on 2026-06-25 by the CNA facts@wolfssl.com, and the vendor's security vulnerabilities page is listed as a vendor advisory.

Impact

  • The confirmed description is an out-of-bounds read on the heap in a PKCS7 parsing path.
  • The record says the issue could theoretically be triggered by attacker-supplied data delivered via S/MIME or CMS.
  • The NVD CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H with a base score of 9.1. The vector indicates network reachability, low complexity, no privileges or user interaction required, and high confidentiality and availability impact.
  • The CNA's CVSS 4.0 score is 6.3. The two scores come from different scoring versions and providers, so they should not be merged.
  • Whether an out-of-bounds read leads to information disclosure, a crash, or other effects in a given deployment is an inference and is not described in the record.

Affected products and versions

  • Product: Wolfssl Wolfssl (wolfSSL)
  • Recorded affected range: from 5.8.0 up to, but not including, 5.9.2.
  • The record does not list any other affected branches or distributions.

Exploitation status

The KEV catalog entry for this CVE is not listed in the record. No confirmed exploitation or active exploitation appears in the sources consulted for this analysis. EPSS and SSVC data are not present in the record.

Remediation and mitigation

  • The fixes section of the record points to a patch in the wolfSSL GitHub repository, pull request 10128.
  • The record does not state an explicit fixed version. Because the recorded affected range ends before 5.9.2, a release at or beyond 5.9.2 is outside that range, which is an inference that should be checked against the vendor advisory.
  • Inventory wolfSSL usage in products and internal tools, prioritising systems within the recorded range that accept S/MIME or CMS input from untrusted parties.
  • Where patching is not immediately possible, restrict which external sources can submit data to services that parse PKCS7 or CMS structures, as a defensive measure.

Detection guidance

  • Identify hosts and build artefacts that embed wolfSSL and report their versions against the recorded range.
  • Review crash reports and service restarts in processes that decode S/MIME or CMS messages, since memory-safety faults can surface that way.
  • Log and alert on repeated decoding failures from untrusted inputs to crypto-handling services.
  • Detection of exploitation attempts is not described in the record; these suggestions are general defensive practices.

Limitations of the available information

  • The record provides no details about the exact input structure, the conditions required to reach the read, or the data that could be exposed.
  • No EPSS, SSVC, or KEV data is available in the record.
  • The title field was empty in the source record; the title used here is derived from the description.
  • The explicit fixed version is not stated in the record.

Frequently asked questions

What is CVE-2026-6094?

It is a heap buffer overread in the wc_PKCS7_DecodeEnvelopedData routine of wolfSSL, triggered when parsing crafted PKCS7 EnvelopedData.

Which wolfSSL versions are affected?

The record lists the affected range as from 5.8.0 up to, but not including, 5.9.2.

Is this vulnerability known to be exploited?

The record does not list the CVE in the KEV catalog, and no confirmed exploitation appears in the sources consulted.

Is there a fix available?

The record links a patch in the wolfSSL GitHub repository, pull request 10128, but does not state an explicit fixed version.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.