CVE-2026-4395Heap-based Buffer Overflow in Wolfssl

Severity
1.3LOWNVD
EPSS
0.1%
top 68.09%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedMar 19

Description

Heap-based buffer overflow in the KCAPI ECC code path of wc_ecc_import_x963_ex() in wolfSSL wolfcrypt allows a remote attacker to write attacker-controlled data past the bounds of the pubkey_raw buffer via a crafted oversized EC public key point. The WOLFSSL_KCAPI_ECC code path copies the input to key->pubkey_raw (132 bytes) using XMEMCPY without a bounds check, unlike the ATECC code path which includes a length validation. This can be triggered during TLS key exchange when a malicious peer send

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Affected Packages6 packages

debiandebian/wolfssl< wolfssl 5.9.0-0.1 (forky)
NVDwolfssl/wolfssl< 5.9.0
Debianwolfssl/wolfssl< 5.9.0-0.1
CVEListV5wolfssl/wolfssl5.8.4

Patches

🔴Vulnerability Details

2
OSV
CVE-2026-4395: Heap-based buffer overflow in the KCAPI ECC code path of wc_ecc_import_x963_ex() in wolfSSL wolfcrypt allows a remote attacker to write attacker-contr2026-03-19
GHSA
GHSA-cqx9-3cpj-rrqp: Heap-based buffer overflow in the KCAPI ECC code path of wc_ecc_import_x963_ex() in wolfSSL wolfcrypt allows a remote attacker to write attacker-contr2026-03-19

📋Vendor Advisories

2
Microsoft
Heap-based buffer overflow in wc_ecc_import_x963_ex KCAPI path2026-03-10
Debian
CVE-2026-4395: wolfssl - Heap-based buffer overflow in the KCAPI ECC code path of wc_ecc_import_x963_ex()...2026

🕵️Threat Intelligence

16
Wiz
CVE-2026-4395 Impact, Exploitability, and Mitigation Steps | Wiz
Wiz
CVE-2026-3580 Impact, Exploitability, and Mitigation Steps | Wiz
Wiz
CVE-2026-3549 Impact, Exploitability, and Mitigation Steps | Wiz
Wiz
CVE-2026-0819 Impact, Exploitability, and Mitigation Steps | Wiz
Wiz
CVE-2026-3229 Impact, Exploitability, and Mitigation Steps | Wiz
CVE-2026-4395 — Heap-based Buffer Overflow in Wolfssl | cvebase