Stack buffer overflow in PKCS7 SignedData encoding with custom signed attributes
Summary
Stack buffer overflow in PKCS7 SignedData encoding with custom signed attributes
Original description
The description as published by the source.
A stack buffer overflow vulnerability exists in wolfSSL's PKCS7 SignedData encoding functionality. In wc_PKCS7_BuildSignedAttributes(), when adding custom signed attributes, the code passes an incorrect capacity value (esd->signedAttribsCount) to EncodeAttributes() instead of the remaining available space in the fixed-size signedAttribs[7] array. When an application sets pkcs7->signedAttribsSz to a value greater than MAX_SIGNED_ATTRIBS_SZ (default 7) minus the number of default attributes already added, EncodeAttributes() writes beyond the array bounds, causing stack memory corruption. In WOLFSSL_SMALL_STACK builds, this becomes heap corruption. Exploitation requires an application that allows untrusted input to control the signedAttribs array size when calling wc_PKCS7_EncodeSignedData() or related signing functions.
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2026-0819 wolfssl
- Ubuntu UBUNTU-CVE-2026-0819 wolfssl
References
- advisory github.com
- advisory nvd.nist.gov
- package github.com
- patch github.com