CVE-2026-5187: Heap Out-of-Bounds Write in DecodeObjectId() in wolfSSL
Two potential heap out-of-bounds write locations existed in DecodeObjectId() in wolfcrypt/src/asn.c. First, a bounds check only validates one available slot before writing two OID arc values (out[0] and out[1]), enabling a 2-byte out-of-bounds write when outSz equals 1. Second, multiple callers pass sizeof(decOid) (64 bytes on 64-bit platforms) instead of the element count MAXOIDSZ (32), causing the function to accept crafted OIDs with 33 or more arcs that write past the end of the allocated buffer.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5187?
CVE-2026-5187 has been assigned a high severity rating due to the potential for heap out-of-bounds writes.
How do I fix CVE-2026-5187?
To fix CVE-2026-5187, update wolfSSL to version 5.10.0 or greater, which addresses the vulnerability.
Which versions of wolfSSL are affected by CVE-2026-5187?
CVE-2026-5187 affects all versions of wolfSSL up to 5.9.0 inclusive.
What components of wolfSSL are impacted by CVE-2026-5187?
The vulnerability is specifically found in the DecodeObjectId() function within the wolfCrypt library.
Can CVE-2026-5187 lead to exploitation?
Yes, CVE-2026-5187 can lead to potential arbitrary code execution or crashes if exploited.