CVE-2026-5477: wolfCrypt CMAC Integer Overflow Vulnerability

CVE-2026-5477 Overview

An integer overflow vulnerability exists in the wolfCrypt CMAC (Cipher-based Message Authentication Code) implementation that allows attackers to forge CMAC authentication tags. The vulnerability resides in the wc_CmacUpdate function, which uses a guard condition if (cmac->totalSz != 0) to skip XOR-chaining on the first block. Because totalSz is defined as word32, it wraps to zero after 2^28 block flushes (approximately 4 GiB of processed data), causing the guard to erroneously discard the live CBC-MAC chain state. This enables a zero-work prefix-substitution forgery attack where any two messages sharing a common suffix beyond the 4 GiB boundary produce identical CMAC tags.

Critical Impact

Cryptographic authentication bypass allowing CMAC tag forgery without computational effort, undermining message integrity verification in systems processing large data volumes.

Affected Products

• wolfSSL wolfCrypt library (versions prior to the fix)
• Applications using wolfCrypt CMAC for message authentication
• Systems processing messages exceeding 4 GiB through CMAC verification

Discovery Timeline

• 2026-04-10 - CVE CVE-2026-5477 published to NVD
• 2026-04-13 - Last updated in NVD database

Technical Details for CVE-2026-5477

Vulnerability Analysis

This integer overflow vulnerability (CWE-190) affects the wolfCrypt CMAC implementation's state tracking mechanism. The core issue lies in how the wc_CmacUpdate function manages XOR-chaining operations during message authentication.

The function uses a conditional guard that checks whether totalSz equals zero to determine if XOR-chaining should be skipped on the first block—a valid optimization since the digest is all-zeros initially and the XOR operation would be a no-op. However, the totalSz variable is defined as a 32-bit unsigned integer (word32), which can only represent values up to 4,294,967,295 (2^32 - 1).

When processing data, the counter eventually wraps around to zero after 2^28 block flushes (each block being 16 bytes in AES-CMAC), equivalent to processing approximately 4 GiB of data. This wraparound causes the guard condition to evaluate as true again, incorrectly treating subsequent blocks as if they were the first block and discarding the accumulated CBC-MAC chain state.

Root Cause

The root cause is an integer overflow in the totalSz counter variable used for state tracking in the CMAC implementation. The use of a fixed-width 32-bit integer without overflow protection creates a predictable wraparound condition. The conditional logic relying on this counter for critical cryptographic state management introduces a vulnerability when the counter overflows.

The fix removes the conditional guard entirely, making the XOR operation unconditional. This preserves the no-op property on the first block (since digest is zero-initialized by wc_InitCmac_ex) while eliminating the integer overflow attack vector.

Attack Vector

The attack exploits the network-accessible nature of services using wolfCrypt CMAC authentication. An attacker can craft two distinct messages that share a common suffix beyond the 4 GiB boundary. Due to the integer overflow causing the CBC-MAC state to reset, both messages will produce identical CMAC tags despite having different prefixes.

This enables a prefix-substitution forgery attack where an attacker can:

1. Observe a valid message with its CMAC tag
2. Construct a malicious message with the same suffix (beyond 4 GiB)
3. Submit the forged message with the original tag
4. The verification will succeed, bypassing authentication

The vulnerability requires no interaction from targeted users and can be exploited remotely over a network connection.

Detection Methods for CVE-2026-5477

Indicators of Compromise

• Unexpected CMAC authentication successes for messages with distinct prefixes but matching tags
• Large data processing sessions exceeding 4 GiB through CMAC verification routines
• Anomalous patterns in authenticated message traffic suggesting prefix manipulation

Detection Strategies

• Monitor for wolfSSL/wolfCrypt library versions prior to the security patch
• Implement logging for CMAC verification operations on messages approaching or exceeding 4 GiB
• Deploy network traffic analysis to identify suspicious patterns in authenticated communications
• Audit systems for applications using wc_CmacUpdate with large cumulative data volumes

Monitoring Recommendations

• Enable verbose logging for cryptographic operations in wolfCrypt-dependent applications
• Set alerts for CMAC processing sessions approaching the 4 GiB threshold
• Monitor for duplicate CMAC tags appearing across distinct messages
• Implement integrity checking for critical authenticated data streams

How to Mitigate CVE-2026-5477

Immediate Actions Required

• Update wolfSSL/wolfCrypt to the patched version that removes the vulnerable guard condition
• Review and audit applications processing large data volumes through CMAC authentication
• Consider implementing application-level message size limits below the 4 GiB threshold as a temporary measure
• Verify the integrity of data authenticated via CMAC during the vulnerable period

Patch Information

The vulnerability has been addressed through a fix that removes the conditional guard in wc_CmacUpdate, making the XOR operation unconditional. Technical details and the patch implementation are available in the wolfSSL GitHub Pull Request. The fix preserves the no-op optimization for the first block through the zero-initialization performed by wc_InitCmac_ex rather than relying on the vulnerable counter check.

Workarounds

• Implement application-level restrictions to prevent CMAC processing of data volumes exceeding 4 GiB per session
• Partition large data streams into smaller authenticated segments below the overflow threshold
• Consider using alternative authentication mechanisms (HMAC) for applications processing large data volumes until patching is complete
• Monitor and audit CMAC operations for any signs of exploitation

# Configuration example
# Verify wolfSSL version and check for vulnerable CMAC implementation
# List installed wolfSSL version
wolfssl-config --version

# Check for the patched wc_CmacUpdate function (after updating)
# Ensure unconditional XOR operation in CMAC processing
grep -n "totalSz" /path/to/wolfssl/wolfcrypt/src/cmac.c