CVE-2026-5448

Name: CVE-2026-5448
Creator: NVD / NIST
Published: 2026-04-10T00:16:35.89+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

LOWCVSS 2.3/10EPSS 0.12%

Last modified Jun 17, 2026

CVE-2026-5448 is a low-severity vulnerability rated 2.3/10 on the CVSS scale. X.509 date buffer overflow in wolfSSL_X509_notAfter / wolfSSL_X509_notBefore. A buffer overflow may occur when parsing date fields from a crafted X.509 certificate via the compatibility layer API. EPSS estimates a 0.12% chance of exploitation in the next 30 days.

Description

X.509 date buffer overflow in wolfSSL_X509_notAfter / wolfSSL_X509_notBefore. A buffer overflow may occur when parsing date fields from a crafted X.509 certificate via the compatibility layer API. This is only triggered when calling these two APIs directly from an application, and does not affect TLS or certificate verify operations in wolfSSL.

Metrics

CVSS 3.1

4.3/10

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CVSS 4.0

2.3/10

CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green

EPSS Probability

0.12%

2.3th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-122

Affected Software

Vendor	Product	Versions
Wolfssl	Wolfssl	< 5.9.1

References

https://github.com/wolfSSL/wolfssl/pull/10071Issue Tracking, Patch

Timeline

Published: Apr 10, 2026
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2026-5448?

How severe is CVE-2026-5448?

CVE-2026-5448 has a CVSS score of 2.3/10 (LOW severity). The EPSS model estimates a 0.12% probability of exploitation in the next 30 days.

How do I fix CVE-2026-5448?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2026-5448?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST