CVE-2026-6094: 
wolfSSL vulnerability analysis and mitigation

CVE-2026-6094 is a heap buffer overread vulnerability in wolfSSL's wc_PKCS7_DecodeEnvelopedData function, triggered when parsing crafted PKCS7 EnvelopedData structures. It affects wolfSSL versions 5.8.0 through 5.9.1 and can theoretically be exploited via attacker-supplied data delivered through S/MIME or CMS messages. The vulnerability was published on June 25, 2026, with a patch merged into the wolfSSL master branch on April 23, 2026. It carries a CVSS v3.1 base score of 9.1 (Critical) and a CVSS v4.0 base score of 6.3 (Medium) (GitHub Advisory, wolfSSL PR).

The root cause is an out-of-bounds read (CWE-125) in wolfcrypt/src/pkcs7.c, where the wc_PKCS7_DecodeEnvelopedData function fails to validate that encryptedContentTotalSz does not exceed the total message size before using it in the non-streaming case. This allows a heap buffer overread when processing a specially crafted PKCS7 EnvelopedData message. The fix, contributed by Zou Dikai and merged in PR #10128, adds a bounds check before caching encrypted content and also corrects the signed attributes count to reflect only attributes actually added. Exploitation requires the target application to process attacker-controlled S/MIME or CMS data, which is a realistic precondition for mail gateways, email clients, or any service parsing such messages (wolfSSL PR, GitHub Advisory).

Successful exploitation can result in two primary impacts: disclosure of sensitive data from heap memory (confidentiality) and application crash (availability). An unauthenticated remote attacker can send a crafted S/MIME or CMS message to cause the affected application to read beyond the intended heap buffer, potentially exposing cryptographic keys, plaintext data, or other sensitive in-memory content, and crashing the service. Integrity is not directly impacted, and there is no evidence of lateral movement capability from this vulnerability alone (GitHub Advisory, wolfSSL Security).

1. Identify target: Locate services or applications using wolfSSL versions 5.8.0–5.9.1 that process S/MIME or CMS messages from external sources (e.g., email gateways, secure messaging endpoints).
2. Craft malicious PKCS7 EnvelopedData: Construct a PKCS7 EnvelopedData structure with a manipulated encryptedContentTotalSz field that exceeds the actual message buffer size, designed to trigger the missing bounds check in wc_PKCS7_DecodeEnvelopedData.
3. Deliver payload: Send the crafted message to the target via S/MIME email or a CMS-processing API endpoint, requiring no authentication or user interaction.
4. Trigger overread: The vulnerable wc_PKCS7_DecodeEnvelopedData function reads beyond the intended heap buffer, potentially leaking adjacent heap memory contents or causing a crash (denial of service).
5. Collect leaked data or confirm DoS: Depending on heap layout, the attacker may receive out-of-bounds heap data in an error response or observe the application crash, confirming successful exploitation (wolfSSL PR, GitHub Advisory).

• Logs: Unexpected application crashes or error logs referencing wc_PKCS7_DecodeEnvelopedData, BUFFER_E, or WC_KEY_SIZE_E in wolfSSL-linked services; repeated parsing failures for S/MIME or CMS messages from external sources.
• Network: Unusual or malformed S/MIME/CMS messages arriving at mail gateways or API endpoints, particularly those with anomalously large encryptedContentTotalSz values relative to the actual message size.
• Process: Abnormal termination (segfault or abort) of processes linked against wolfSSL 5.8.0–5.9.1 when processing inbound encrypted messages; core dumps generated by the affected service.

The primary remediation is to upgrade wolfSSL to version 5.9.2 or later, which includes the bounds check fix merged in PR #10128 on April 23, 2026. If immediate patching is not feasible, restrict network access to services that process S/MIME or CMS messages from untrusted sources, and consider filtering or rejecting externally supplied PKCS7 EnvelopedData at the network perimeter. Monitor affected applications (wolfSSL 5.8.0–5.9.1) for unexpected crashes or anomalous behavior as an interim measure (wolfSSL Security, wolfSSL PR).

The vulnerability was reported to wolfSSL by researcher Zou Dikai (referenced in the fix commits as zd#21526 and zd#21530), and the fix was developed internally by the wolfSSL team. The GitHub Advisory Database classified it as "Moderate" severity based on CVSS v4.0 scoring. No significant broader media coverage or notable community commentary beyond standard vulnerability tracking sites has been observed (wolfSSL PR, GitHub Advisory).