CVE-2026-5295

A stack buffer overflow exists in wolfSSL's PKCS7 implementation in the wc_PKCS7_DecryptOri() function in wolfcrypt/src/pkcs7.c. When processing a CMS EnvelopedData message containing an OtherRecipientInfo (ORI) recipient, the function copies an ASN.1-parsed OID into a fixed 32-byte stack buffer (oriOID[MAX_OID_SZ]) via XMEMCPY without first validating that the parsed OID length does not exceed MAX_OID_SZ. A crafted CMS EnvelopedData message with an ORI recipient containing an OID longer than 32 bytes triggers a stack buffer overflow. Exploitation requires the library to be built with --enable-pkcs7 (disabled by default) and the application to have registered an ORI decrypt callback via wc_PKCS7_SetOriDecryptCb().

• CWE-121

• https://github.com/wolfSSL/wolfssl/pull/10116Issue Tracking, Patch

Published

Apr 9, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-52944In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-52945In the Linux kernel, the following vulnerability has been re…7.5
• CVE-2026-52946In the Linux kernel, the following vulnerability has been re…7.5
• CVE-2026-52947In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-52948In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-52949In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-52950In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-52951In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-52952In the Linux kernel, the following vulnerability has been re…8.8
• CVE-2026-52953In the Linux kernel, the following vulnerability has been re…7.1
• CVE-2026-52954In the Linux kernel, the following vulnerability has been re…7.5
• CVE-2026-52955In the Linux kernel, the following vulnerability has been re…9.8