Heap Use-After-Free Vulnerability in wolfSSL Product

CVE-2026-15442

What is CVE-2026-15442?

A vulnerability exists in the wolfSSL TLS library, where a series of conditional states during the TLS shutdown process can lead to a heap-use-after-free situation. This occurs when an application experiences a partial wolfSSL_read() due to a small user buffer being passed in. If the application subsequently calls wolfSSL_shutdown for a bidirectional close while the peer continues to send data, it may trigger a scenario where a heap-use-after-free vulnerability is exposed. This could potentially compromise application stability and lead to unexpected behavior within the system.

References