PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-6678 wolfSSL CVE debrief

CVE-2026-6678 is an integer underflow vulnerability in the wc_PKCS7_DecryptOri function of wolfSSL, a popular cryptographic library. The vulnerability occurs when handling crafted 'Other Recipient Info', which can lead to incorrect length handling during decryption. This issue was reported with a CVSS score of 1 and a severity of LOW. The CVE was published on June 25, 2026, and modified on July 1, 2026. The vulnerability affects wolfSSL versions from 3.15.5 up to but not including 5.9.2.

Vendor
wolfSSL
Product
Unknown
CVSS
LOW 1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-25
Original CVE updated
2026-07-01
Advisory published
2026-06-25
Advisory updated
2026-07-01

Who should care

Organizations using wolfSSL for cryptographic operations should be aware of this vulnerability. Specifically, those who have not upgraded to a version of wolfSSL that includes the fix for this issue should take immediate action. This vulnerability, while rated as LOW, can still pose a risk if exploited, especially in environments where wolfSSL is used extensively.

Technical summary

The integer underflow vulnerability in wc_PKCS7_DecryptOri can be triggered by crafted 'Other Recipient Info'. This can cause incorrect length handling during the decryption process, potentially leading to security issues. The Common Weakness Enumeration (CWE) for this vulnerability is CWE-191, indicating an integer underflow. The CVSS vector for this vulnerability is CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear, indicating a localized attack vector with high attack complexity.

Defensive priority

Given the LOW severity and localized attack vector, the defensive priority for this vulnerability is moderate. Organizations should prioritize patching this vulnerability as part of their regular security update cycles, especially if they are using affected versions of wolfSSL.

Recommended defensive actions

  • Upgrade to a version of wolfSSL that is not affected by this vulnerability (e.g., version 5.9.2 or later).
  • Review and update CPE configurations to ensure accurate tracking of wolfSSL versions.
  • Implement compensating controls such as additional monitoring for suspicious decryption activities.
  • Consider applying network access controls to limit exposure to potential attackers.
  • Regularly review and update cryptographic libraries and dependencies.

Evidence notes

The evidence for this CVE comes from the National Vulnerability Database (NVD) and the wolfSSL GitHub repository. The NVD provides detailed information about the vulnerability, including its CVSS score and vector. The wolfSSL GitHub repository contains the patch for this issue, confirming its existence and impact.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-6678 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-6678

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-6678 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-6678

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.