CVE-2026-5187
Heap Out-of-Bounds Write in DecodeObjectId() in wolfSSL
Summary
Heap Out-of-Bounds Write in DecodeObjectId() in wolfSSL
Original description
The description as published by the source.
Two potential heap out-of-bounds write locations existed in DecodeObjectId() in wolfcrypt/src/asn.c. First, a bounds check only validates one available slot before writing two OID arc values (out[0] and out[1]), enabling a 2-byte out-of-bounds write when outSz equals 1. Second, multiple callers pass sizeof(decOid) (64 bytes on 64-bit platforms) instead of the element count MAX_OID_SZ (32), causing the function to accept crafted OIDs with 33 or more arcs that write past the end of the allocated buffer.
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2026-5187 wolfssl
- Ubuntu UBUNTU-CVE-2026-5187 wolfssl
References
- advisory github.com
- advisory nvd.nist.gov
- package github.com