CVE-2026-6678: 
wolfSSL vulnerability analysis and mitigation

CVE-2026-6678 is an integer underflow vulnerability in the wc_PKCS7_DecryptOri function of wolfSSL, affecting the PKCS#7 OtherRecipientInfo decryption path. A specially crafted malformed ASN.1 record can trigger incorrect length handling, potentially leading to a heap buffer overflow. The vulnerability affects wolfSSL versions 3.15.5 through 5.9.1 and was disclosed on June 25, 2026, with a patch released in wolfSSL v5.9.2 on June 23, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) per NVD, though Cisco Talos rates it 7.5 (High) based on network-exploitable denial-of-service impact; the CVSS v4.0 base score is 1.0 (Low) (GitHub Advisory, Talos Report).

The root cause is an integer underflow (CWE-191) in wc_PKCS7_DecryptOri within wolfcrypt/src/pkcs7.c. When parsing the OtherRecipientInfo (ORI) portion of a PKCS#7 message, the function reads an attacker-controlled sequence length (seqSz) via GetLength(), then computes oriValueSz = (word32)seqSz - (*idx - tmpIdx) without validating that seqSz is large enough to accommodate the already-consumed bytes. If the attacker crafts a pkiMsg where seqSz is smaller than (*idx - tmpIdx), the subtraction wraps around to an extremely large unsigned integer (e.g., 4294967293), which is then used to advance idx and passed to a user-defined callback operating on out-of-bounds data. Exploitation requires sending a crafted PKCS#7 message to a service using the affected wolfSSL library (Talos Report, GitHub PR).

Successful exploitation causes incorrect length handling during PKCS#7 decryption, with consequences ranging from unexpected behavior and process crashes (denial of service) to potential heap buffer overflow conditions depending on the implementation. There is no confidentiality or integrity impact identified; the primary risk is availability loss for services relying on wolfSSL for PKCS#7 message processing. In embedded or IoT environments where wolfSSL is commonly deployed, a crash of the cryptographic library could disrupt critical operations (Talos Report, GitHub Advisory).

1. Identify target: Locate a service or application using wolfSSL versions 3.15.5 through 5.9.1 that processes PKCS#7 EnvelopedData messages with OtherRecipientInfo (ORI) support enabled.
2. Craft malformed ASN.1 record: Construct a PKCS#7 message containing an OtherRecipientInfo sequence where the declared sequence length (seqSz) is intentionally smaller than the number of bytes already consumed by the OID parsing step (*idx - tmpIdx).
3. Trigger integer underflow: Submit the crafted message to the target service. When wc_PKCS7_DecryptOri processes the ORI, the computation oriValueSz = (word32)seqSz - (*idx - tmpIdx) wraps around to a very large value (e.g., 4294967293).
4. Achieve impact: The wrapped oriValueSz is used to advance the index pointer far beyond valid buffer bounds and is passed to the user-defined oriDecryptCb callback, causing the callback to operate on out-of-bounds memory — resulting in a crash or heap corruption depending on the implementation (Talos Report).

• Logs: Application or service crash logs referencing wolfSSL PKCS#7 decryption failures or ASN.1 parse errors; unexpected process termination of services using wolfSSL.
• Network: Unusual or malformed PKCS#7/CMS messages received by services using wolfSSL, particularly those with anomalous OtherRecipientInfo sequence lengths; repeated connection attempts followed by service crashes.
• Process: Abnormal termination (segmentation fault, heap corruption) of processes linked against wolfSSL versions prior to 5.9.2 when handling encrypted message inputs.

Upgrade wolfSSL to version 5.9.2 or later, which was released on June 23, 2026, and includes fixes for this and multiple other PKCS#7 issues addressed in PR #10203. As an interim measure, restrict network access to services using affected wolfSSL versions and implement input validation or filtering on PKCS#7 messages where feasible. Organizations should consult the wolfSSL security vulnerabilities page for the full list of addressed issues (wolfSSL Security, GitHub PR).

Cisco Talos published a detailed technical report (TALOS-2026-2408) on July 1, 2026, crediting researcher Ankur Tyagi for the discovery and providing a thorough code-level analysis of the underflow condition (Talos Report). wolfSSL acknowledged the issue and released a patch in v5.9.2 prior to public disclosure, following coordinated disclosure practices. No significant broader community or social media discussion has been observed beyond standard CVE tracking and aggregator coverage.