CVE-2026-5477: 
wolfSSL vulnerability analysis and mitigation

CVE-2026-5477 is an integer overflow vulnerability in the wolfCrypt CMAC implementation within wolfSSL that enables prefix-substitution forgery of CMAC authentication tags. The flaw exists in the wc_CmacUpdate function, where the totalSz counter (typed as word32) wraps to zero after processing 4 GiB of data (2^28 block flushes), causing the CBC-MAC chain state to be erroneously discarded. This allows any two messages sharing a common suffix beyond the 4 GiB mark to produce identical CMAC tags, enabling zero-work forgery. Affected versions are wolfSSL up to and including 5.9.0; the fix was introduced in wolfSSL 5.9.2. The vulnerability carries a CVSS v3.1 score of 7.5 (High) and a CVSS v4.0 score of 8.2 (High) (GitHub Advisory, wolfSSL PR #10102).

The root cause is an integer overflow or wraparound (CWE-190) in the wc_CmacUpdate function in wolfCrypt. The function used the guard if (cmac->totalSz != 0) to skip XOR-chaining on the first block, since the digest is all-zeros and the XOR would be a no-op. However, totalSz is declared as word32 (a 32-bit unsigned integer), which wraps to zero after 2^28 block flushes (equivalent to 4 GiB of processed data). When this wraparound occurs, the guard fires again as if it were the first block, discarding the live CBC-MAC chain state. The result is that any two messages sharing a common suffix beyond the 4 GiB boundary produce identical CMAC tags, enabling a prefix-substitution forgery attack with no cryptographic work required. The fix removes the guard entirely, making the XOR unconditional; correctness on the first block is preserved because digest is zero-initialized by wc_InitCmac_ex (wolfSSL PR #10102, GitHub Advisory). The vulnerability was identified by Nicholas Carlini (Anthropic) and Thai Duong (Calif.io) (wolfSSL PR #10102).

Successful exploitation completely undermines message authentication integrity for any system using wolfCrypt's CMAC for data volumes exceeding 4 GiB. An attacker can forge valid CMAC tags without performing any cryptographic computation, effectively bypassing integrity verification and enabling undetected message tampering. There is no confidentiality or availability impact, but the integrity compromise is total for affected data volumes — any message prefix can be substituted while the forged tag remains accepted as valid (GitHub Advisory, Feedly).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability was responsibly disclosed by Nicholas Carlini (Anthropic) and Thai Duong (Calif.io) and is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.038% (12th percentile), indicating a low near-term exploitation probability. Exploitation requires the attacker to be able to submit or influence messages processed through the CMAC function at volumes exceeding 4 GiB, which represents a meaningful precondition (GitHub Advisory).

1. Identify target: Locate a system using wolfSSL ≤ 5.9.0 that employs CMAC (via wc_CmacUpdate) for message authentication, particularly in contexts where large data streams or cumulative session data can exceed 4 GiB.
2. Trigger integer overflow: Interact with the target system in a way that causes wc_CmacUpdate to process at least 4 GiB of data (2^28 block flushes of 16-byte AES blocks), causing totalSz (word32) to wrap to zero.
3. Exploit state reset: After the wraparound, the guard if (cmac->totalSz != 0) evaluates as false, causing the live CBC-MAC chain state to be discarded and the digest reset to all-zeros — as if processing were starting fresh.
4. Craft forged message: Prepare a substitute message prefix that differs from the original, but shares a common suffix with the legitimate message beyond the 4 GiB mark. Both messages will now produce identical CMAC tags due to the discarded chain state.
5. Submit forged message: Present the crafted message with the forged (but valid) CMAC tag to the target system. The tag will be accepted as authentic, completing the prefix-substitution forgery with zero cryptographic work (wolfSSL PR #10102, GitHub Advisory).

• Logs: Anomalous patterns of large data submissions (>4 GiB per session or cumulative) to services using wolfSSL CMAC authentication; repeated or unusual CMAC verification requests in application logs.
• Network: Unusually large data transfers to services protected by wolfSSL CMAC; sessions that appear to process multi-gigabyte payloads in a single CMAC context.
• Application Behavior: Acceptance of messages with authentication tags that should have failed verification, particularly for large data streams; unexpected successful authentication of modified or substituted message content.

The fix is included in wolfSSL version 5.9.2, released via pull request #10102 merged on April 6, 2026. Organizations should upgrade to wolfSSL 5.9.2 or later as the primary remediation (wolfSSL PR #10102). For systems unable to patch immediately, operational mitigations include: (1) monitoring and limiting individual message or session sizes to remain below the 4 GiB threshold, (2) implementing additional authentication mechanisms beyond CMAC as defense-in-depth, and (3) prioritizing patching for systems processing high-volume cryptographic data (Feedly).

The vulnerability was discovered and responsibly disclosed by Nicholas Carlini (Anthropic) and Thai Duong (Calif.io), who also identified several other cryptographic flaws in wolfSSL addressed in the same pull request (wolfSSL PR #10102). VulnCheck published a blog post referencing Anthropic's credited CVEs, highlighting the role of AI safety researchers in identifying cryptographic implementation flaws (VulnCheck Blog). The vulnerability was discussed on the oss-security mailing list and noted in the ENISA European Vulnerability Database (EUVD-2026-21305) (oss-sec).