Medium severity · published Jun 25, 2026
CVE-2026-6681
PKCS#7 decode ignores caller output buffer size, writing past buffer bounds
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
The PKCS#7 decode path ignores the caller-supplied output buffer size (outputSz), allowing decoded content to be written past the bounds of the provided buffer. This affects wolfSSL 5.9.0 and earlier and was fixed in the 5.9.1 release.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WO
wolfSSL · wolfSSL
3.10.0 through 5.9.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-6681
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-6681
Issue Tracking
https://github.com/wolfSSL/wolfssl/pull/10116
Vendor Advisory
https://www.wolfssl.com/docs/security-vulnerabilities/
More from wolfSSL
9.8
CVE-2026-7531
Use-after-free in PQC hybrid key-share handling
9.8
CVE-2026-5264
DTLS 1.3 ACK heap buffer overflow
9.8
CVE-2026-5187
Heap Out-of-Bounds Write in DecodeObjectId() in wolfSSL
9.8
CVE-2026-4395
Heap-based buffer overflow in wc_ecc_import_x963_ex KCAPI path
9.8
CVE-2026-3849
Buffer Overflow in HPKE via Oversized ECH Config