Out-of-Bounds Write Vulnerability in Renesas TSIP TLS 1.3 by Renesas

CVE-2026-55958

What is CVE-2026-55958?

An out-of-bounds write vulnerability exists in the Renesas TSIP TLS 1.3 implementation, specifically within the tsip_StoreMessage() function. A flaw in the capacity check allows heap corruption and potential denial of service when the TLS 1.3 handshake transcript exceeds the size limit. This can occur due to unusually large valid certificate chains or malicious servers sending oversized messages to clients that do not validate the chain accurately. The issue primarily affects builds using the Renesas TSIP TLS port on compatible microcontrollers.

References