CVE-2026-5477: wolfCrypt CMAC Integer Overflow Vulnerability

CVE-2026-5477 Overview

An integer overflow vulnerability exists in the wolfCrypt CMAC (Cipher-based Message Authentication Code) implementation that allows attackers to forge CMAC authentication tags. The vulnerability resides in the wc_CmacUpdate function, which uses a guard condition if (cmac->totalSz != 0) to skip XOR-chaining on the first block. Because totalSz is defined as word32, it wraps to zero after 2^28 block flushes (approximately 4 GiB of processed data), causing the guard to erroneously discard the live CBC-MAC chain state. This enables a zero-work prefix-substitution forgery attack where any two messages sharing a common suffix beyond the 4 GiB boundary produce identical CMAC tags.

Critical Impact
Cryptographic authentication bypass allowing CMAC tag forgery without computational effort, undermining message integrity verification in systems processing large data volumes.

Affected Products

wolfSSL wolfCrypt library (versions prior to the fix)
Applications using wolfCrypt CMAC for message authentication
Systems processing messages exceeding 4 GiB through CMAC verification

Discovery Timeline

2026-04-10 - CVE CVE-2026-5477 published to NVD
2026-04-13 - Last updated in NVD database

Technical Details for CVE-2026-5477

Vulnerability Analysis

This integer overflow vulnerability (CWE-190) affects the wolfCrypt CMAC implementation's state tracking mechanism. The core issue lies in how the wc_CmacUpdate function manages XOR-chaining operations during message authentication.

The function uses a conditional guard that checks whether totalSz equals zero to determine if XOR-chaining should be skipped on the first block—a valid optimization since the digest is all-zeros initially and the XOR operation would be a no-op. However, the totalSz variable is defined as a 32-bit unsigned integer (word32), which can only represent values up to 4,294,967,295 (2^32 - 1).

When processing data, the counter eventually wraps around to zero after 2^28 block flushes (each block being 16 bytes in AES-CMAC), equivalent to processing approximately 4 GiB of data. This wraparound causes the guard condition to evaluate as true again, incorrectly treating subsequent blocks as if they were the first block and discarding the accumulated CBC-MAC chain state.

Root Cause

The root cause is an integer overflow in the totalSz counter variable used for state tracking in the CMAC implementation. The use of a fixed-width 32-bit integer without overflow protection creates a predictable wraparound condition. The conditional logic relying on this counter for critical cryptographic state management introduces a vulnerability when the counter overflows.

The fix removes the conditional guard entirely, making the XOR operation unconditional. This preserves the no-op property on the first block (since digest is zero-initialized by wc_InitCmac_ex) while eliminating the integer overflow attack vector.

Attack Vector

The attack exploits the network-accessible nature of services using wolfCrypt CMAC authentication. An attacker can craft two distinct messages that share a common suffix beyond the 4 GiB boundary. Due to the integer overflow causing the CBC-MAC state to reset, both messages will produce identical CMAC tags despite having different prefixes.

This enables a prefix-substitution forgery attack where an attacker can:

Observe a valid message with its CMAC tag
Construct a malicious message with the same suffix (beyond 4 GiB)
Submit the forged message with the original tag
The verification will succeed, bypassing authentication

The vulnerability requires no interaction from targeted users and can be exploited remotely over a network connection.

Detection Methods for CVE-2026-5477

Indicators of Compromise

Unexpected CMAC authentication successes for messages with distinct prefixes but matching tags
Large data processing sessions exceeding 4 GiB through CMAC verification routines
Anomalous patterns in authenticated message traffic suggesting prefix manipulation

Detection Strategies

Monitor for wolfSSL/wolfCrypt library versions prior to the security patch
Implement logging for CMAC verification operations on messages approaching or exceeding 4 GiB
Deploy network traffic analysis to identify suspicious patterns in authenticated communications
Audit systems for applications using wc_CmacUpdate with large cumulative data volumes

Monitoring Recommendations

Enable verbose logging for cryptographic operations in wolfCrypt-dependent applications
Set alerts for CMAC processing sessions approaching the 4 GiB threshold
Monitor for duplicate CMAC tags appearing across distinct messages
Implement integrity checking for critical authenticated data streams

How to Mitigate CVE-2026-5477

Immediate Actions Required

Update wolfSSL/wolfCrypt to the patched version that removes the vulnerable guard condition
Review and audit applications processing large data volumes through CMAC authentication
Consider implementing application-level message size limits below the 4 GiB threshold as a temporary measure
Verify the integrity of data authenticated via CMAC during the vulnerable period

Patch Information

The vulnerability has been addressed through a fix that removes the conditional guard in wc_CmacUpdate, making the XOR operation unconditional. Technical details and the patch implementation are available in the wolfSSL GitHub Pull Request. The fix preserves the no-op optimization for the first block through the zero-initialization performed by wc_InitCmac_ex rather than relying on the vulnerable counter check.

Workarounds

Implement application-level restrictions to prevent CMAC processing of data volumes exceeding 4 GiB per session
Partition large data streams into smaller authenticated segments below the overflow threshold
Consider using alternative authentication mechanisms (HMAC) for applications processing large data volumes until patching is complete
Monitor and audit CMAC operations for any signs of exploitation

bash

# Configuration example
# Verify wolfSSL version and check for vulnerable CMAC implementation
# List installed wolfSSL version
wolfssl-config --version

# Check for the patched wc_CmacUpdate function (after updating)
# Ensure unconditional XOR operation in CMAC processing
grep -n "totalSz" /path/to/wolfssl/wolfcrypt/src/cmac.c