CVE-2026-5295: Stack Buffer Overflow in wolfSSL PKCS7 wc_PKCS7_DecryptOri() via Oversized OID
A stack buffer overflow exists in wolfSSL's PKCS7 implementation in the wcPKCS7DecryptOri() function in wolfcrypt/src/pkcs7.c. When processing a CMS EnvelopedData message containing an OtherRecipientInfo (ORI) recipient, the function copies an ASN.1-parsed OID into a fixed 32-byte stack buffer (oriOID[MAXOIDSZ]) via XMEMCPY without first validating that the parsed OID length does not exceed MAXOIDSZ. A crafted CMS EnvelopedData message with an ORI recipient containing an OID longer than 32 bytes triggers a stack buffer overflow. Exploitation requires the library to be built with --enable-pkcs7 (disabled by default) and the application to have registered an ORI decrypt callback via wcPKCS7SetOriDecryptCb().
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5295?
CVE-2026-5295 has been classified as a high severity vulnerability due to the potential for arbitrary code execution.
How do I fix CVE-2026-5295?
To resolve CVE-2026-5295, update wolfSSL to version 5.9.1 or later, which contains the necessary patches.
What causes the stack buffer overflow in CVE-2026-5295?
The stack buffer overflow in CVE-2026-5295 is caused by processing oversized OIDs in the pkcs7_decryptOri() function.
Which versions of wolfSSL are affected by CVE-2026-5295?
CVE-2026-5295 affects wolfSSL versions prior to 5.9.1.
Is CVE-2026-5295 specific to certain environments or platforms?
CVE-2026-5295 is not limited to specific environments; it affects all implementations of wolfSSL's PKCS7 module across supported platforms.