Stack buffer overflow in PKCS7 SignedData encoding with custom signed attributes
Résumé
Stack buffer overflow in PKCS7 SignedData encoding with custom signed attributes
Description d'origine
La description telle que publiée par la source (souvent en anglais).
A stack buffer overflow vulnerability exists in wolfSSL's PKCS7 SignedData encoding functionality. In wc_PKCS7_BuildSignedAttributes(), when adding custom signed attributes, the code passes an incorrect capacity value (esd->signedAttribsCount) to EncodeAttributes() instead of the remaining available space in the fixed-size signedAttribs[7] array. When an application sets pkcs7->signedAttribsSz to a value greater than MAX_SIGNED_ATTRIBS_SZ (default 7) minus the number of default attributes already added, EncodeAttributes() writes beyond the array bounds, causing stack memory corruption. In WOLFSSL_SMALL_STACK builds, this becomes heap corruption. Exploitation requires an application that allows untrusted input to control the signedAttribs array size when calling wc_PKCS7_EncodeSignedData() or related signing functions.
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2026-0819 wolfssl
- Ubuntu UBUNTU-CVE-2026-0819 wolfssl
Références
- advisory github.com
- advisory nvd.nist.gov
- package github.com
- patch github.com