CVE-2026-0819: wolfSSL Buffer Overflow Vulnerability

CVE-2026-0819 Overview

A stack buffer overflow vulnerability exists in wolfSSL's PKCS7 SignedData encoding functionality. The flaw resides in the wc_PKCS7_BuildSignedAttributes() function where, when adding custom signed attributes, the code passes an incorrect capacity value (esd->signedAttribsCount) to EncodeAttributes() instead of the remaining available space in the fixed-size signedAttribs[7] array. When an application sets pkcs7->signedAttribsSz to a value greater than MAX_SIGNED_ATTRIBS_SZ (default 7) minus the number of default attributes already added, EncodeAttributes() writes beyond the array bounds, causing stack memory corruption. In WOLFSSL_SMALL_STACK builds, this becomes heap corruption.

Critical Impact

Memory corruption vulnerability that can lead to integrity and availability impacts when untrusted input controls the signedAttribs array size in cryptographic signing operations.

Affected Products

• wolfSSL library (versions with vulnerable PKCS7 SignedData encoding)
• Applications using wc_PKCS7_EncodeSignedData() or related signing functions
• Systems compiled with WOLFSSL_SMALL_STACK build option (heap corruption variant)

Discovery Timeline

• 2026-03-19 - CVE CVE-2026-0819 published to NVD
• 2026-03-19 - Last updated in NVD database

Technical Details for CVE-2026-0819

Vulnerability Analysis

This vulnerability stems from a classic off-by-one style logic error in bounds checking within wolfSSL's PKCS7 implementation. The wc_PKCS7_BuildSignedAttributes() function is responsible for constructing the signed attributes portion of PKCS7 SignedData structures. When processing custom signed attributes supplied by the calling application, the function incorrectly calculates the available buffer space.

The core issue is a parameter mismatch: instead of passing the remaining capacity of the fixed-size signedAttribs[7] array to EncodeAttributes(), the code passes esd->signedAttribsCount, which represents the current count of attributes rather than available space. This semantic error allows EncodeAttributes() to write beyond the allocated array boundaries when processing user-controlled attribute sizes.

The exploitation scenario requires a local attacker who can influence the signedAttribs array size parameter when an application calls wc_PKCS7_EncodeSignedData() or related signing functions. While this limits the attack surface, applications that process untrusted PKCS7 signing requests or allow user-controlled cryptographic parameters could be vulnerable.

Root Cause

The root cause is CWE-121: Stack-based Buffer Overflow. The vulnerability occurs due to incorrect capacity calculation in wc_PKCS7_BuildSignedAttributes(), where the function passes esd->signedAttribsCount (the current attribute count) to EncodeAttributes() instead of calculating the remaining available slots in the fixed-size signedAttribs[7] array. This logic error causes the encoding function to exceed array bounds when the combined count of default and custom attributes exceeds MAX_SIGNED_ATTRIBS_SZ (7).

Attack Vector

The attack vector requires local access and specific application conditions. An attacker must be able to control the pkcs7->signedAttribsSz value when the application calls PKCS7 signing functions. The attack flow proceeds as follows:

1. The attacker provides input that causes the application to set pkcs7->signedAttribsSz to a value that, when combined with default attributes, exceeds 7
2. The application calls wc_PKCS7_EncodeSignedData() or a related signing function
3. The wc_PKCS7_BuildSignedAttributes() function processes the attributes and calls EncodeAttributes() with incorrect capacity
4. EncodeAttributes() writes beyond the signedAttribs[7] array bounds, corrupting adjacent stack memory

In WOLFSSL_SMALL_STACK builds, the signedAttribs array is heap-allocated, transforming the stack corruption into heap corruption. This may present different exploitation opportunities depending on the heap allocator in use.

The vulnerability mechanism involves the wc_PKCS7_BuildSignedAttributes() function maintaining a fixed-size array of 7 signed attribute entries. When building the attribute list, the function first adds default attributes (such as content type and message digest), then processes any custom attributes specified by the application. The bug occurs because the capacity check uses the wrong variable, allowing writes past the array boundary when too many attributes are specified.

Detection Methods for CVE-2026-0819

Indicators of Compromise

• Unexpected application crashes or segmentation faults during PKCS7 signing operations
• Stack smashing detection alerts from compiler security features (e.g., -fstack-protector)
• Memory corruption errors reported by runtime sanitizers (ASan, MSan)
• Unusual behavior in applications processing PKCS7 SignedData with custom attributes

Detection Strategies

• Deploy application crash monitoring to detect abnormal terminations during cryptographic operations
• Enable AddressSanitizer (ASan) in development and testing environments to catch buffer overflows
• Monitor for applications using wolfSSL PKCS7 signing functions with user-controlled attribute parameters
• Implement input validation to limit signedAttribsSz values before calling wolfSSL functions

Monitoring Recommendations

• Audit applications using wolfSSL to identify those that allow untrusted input to control PKCS7 signing parameters
• Review code paths that call wc_PKCS7_EncodeSignedData(), wc_PKCS7_EncodeSignedData_ex(), or related functions
• Monitor wolfSSL security advisories and the GitHub Pull Request #9630 for updates
• Implement runtime memory protection mechanisms on systems processing untrusted cryptographic data

How to Mitigate CVE-2026-0819

Immediate Actions Required

• Update wolfSSL to the latest patched version that addresses this vulnerability
• Review and audit all applications that use wolfSSL PKCS7 signing functionality
• Implement input validation to ensure signedAttribsSz does not exceed safe limits
• Consider enabling compiler stack protection features (-fstack-protector-strong) as defense-in-depth

Patch Information

The fix for this vulnerability is tracked in GitHub Pull Request #9630. The patch corrects the capacity calculation in wc_PKCS7_BuildSignedAttributes() to pass the actual remaining available space in the signedAttribs array to EncodeAttributes(), rather than the current attribute count. Organizations should apply this fix by updating to a wolfSSL version that includes this correction.

Workarounds

• Implement application-level validation to ensure pkcs7->signedAttribsSz plus default attributes does not exceed MAX_SIGNED_ATTRIBS_SZ (7)
• Avoid allowing untrusted input to directly control PKCS7 signed attribute parameters
• Deploy applications with stack canary protection enabled to detect exploitation attempts
• Consider sandboxing or isolating processes that handle PKCS7 signing operations with untrusted data

# Compile wolfSSL applications with stack protection and sanitizers for detection
gcc -fstack-protector-strong -fsanitize=address -o myapp myapp.c -lwolfssl

# Check current wolfSSL version for vulnerability assessment
wolfssl-config --version

# Review application code for vulnerable function calls
grep -rn "wc_PKCS7_EncodeSignedData\|signedAttribsSz" /path/to/application/