CVE-2026-5187
Heap Out-of-Bounds Write in DecodeObjectId() in wolfSSL
Résumé
Heap Out-of-Bounds Write in DecodeObjectId() in wolfSSL
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Two potential heap out-of-bounds write locations existed in DecodeObjectId() in wolfcrypt/src/asn.c. First, a bounds check only validates one available slot before writing two OID arc values (out[0] and out[1]), enabling a 2-byte out-of-bounds write when outSz equals 1. Second, multiple callers pass sizeof(decOid) (64 bytes on 64-bit platforms) instead of the element count MAX_OID_SZ (32), causing the function to accept crafted OIDs with 33 or more arcs that write past the end of the allocated buffer.
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2026-5187 wolfssl
- Ubuntu UBUNTU-CVE-2026-5187 wolfssl
Références
- advisory github.com
- advisory nvd.nist.gov
- package github.com