Heap Use-After-Free Vulnerability in wolfSSL's TLS 1.3 Post-Quantum Cryptography
CVE-2026-5460
6.3MEDIUM
What is CVE-2026-5460?
A vulnerability in wolfSSL's TLS 1.3 implementation allows for a heap use-after-free scenario during the KeyShare processing of post-quantum cryptography. Specifically, an error in the TLSX_KeyShare_ProcessPqcHybridClient() function can lead to the release of a KyberKey object. A subsequent call to TLSX_KeyShare_FreeAll() results in attempts to write to memory that has already been freed, which poses serious security risks as it could potentially allow an attacker to exploit the residual memory allocations.
Affected Version(s)
wolfSSL 0 < 5.9.1
References
CVSS V4
Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Calvin Young (eWalker Consulting Inc.)
Enoch Chow (Isomorph Cyber)