Heap Out-of-Bounds Write Vulnerability in WolfSSL's Asn.c

CVE-2026-5187

What is CVE-2026-5187?

Two vulnerabilities have been identified in the DecodeObjectId() function within the wolfSSL library's src/asn.c file. The first issue arises from insufficient bounds checking, which only verifies one available slot before attempting to write two Object Identifier (OID) arc values, allowing for a potential 2-byte out-of-bounds write when the output size is set to one. The second issue occurs when multiple function callers incorrectly provide the size of a buffer (64 bytes on 64-bit platforms) instead of the proper element count (32). This results in the acceptance of crafted OIDs with an excessive number of arcs (greater than 32), which can lead to writing beyond the allocated memory buffer, compromising data integrity and security.

References