CVE-2026-0819: Stack buffer overflow in PKCS7 SignedData encoding with custom signed attributes
A stack buffer overflow vulnerability exists in wolfSSL's PKCS7 SignedData encoding functionality. In wcPKCS7BuildSignedAttributes(), when adding custom signed attributes, the code passes an incorrect capacity value (esd->signedAttribsCount) to EncodeAttributes() instead of the remaining available space in the fixed-size signedAttribs[7] array. When an application sets pkcs7->signedAttribsSz to a value greater than MAXSIGNEDATTRIBSSZ (default 7) minus the number of default attributes already added, EncodeAttributes() writes beyond the array bounds, causing stack memory corruption. In WOLFSSLSMALLSTACK builds, this becomes heap corruption. Exploitation requires an application that allows untrusted input to control the signedAttribs array size when calling wcPKCS7EncodeSignedData() or related signing functions.
Affected Software
Remediation
Information
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0819?
CVE-2026-0819 has been assessed as a high severity vulnerability due to the potential for stack buffer overflow which can lead to arbitrary code execution.
How do I fix CVE-2026-0819?
To mitigate CVE-2026-0819, upgrade to the latest version of wolfSSL where the vulnerability has been addressed in the PKCS7 SignedData encoding function.
What causes CVE-2026-0819?
CVE-2026-0819 is caused by incorrect capacity value handling in the wc_PKCS7_BuildSignedAttributes function during the encoding of custom signed attributes.
What software is affected by CVE-2026-0819?
CVE-2026-0819 affects wolfSSL, specifically within its PKCS7 SignedData encoding functionality.
What are the potential impacts of exploiting CVE-2026-0819?
Exploiting CVE-2026-0819 could result in a stack buffer overflow, potentially allowing an attacker to execute arbitrary code on the affected system.