Vulnerability · Published Apr 9, 2026 · Assigned by wolfSSL
CVE-2026-5187Heap Out-of-Bounds Write in DecodeObjectId() in wolfSSL
Low 2.3
In plain English
A low-severity heap buffer overflow in wolfSSL from wolfSSL. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Two potential heap out-of-bounds write locations existed in DecodeObjectId() in wolfcrypt/src/asn.c. First, a bounds check only validates one available slot before writing two OID arc values (out[0] and out[1]), enabling a 2-byte out-of-bounds write when outSz equals 1. Second, multiple callers pass sizeof(decOid) (64 bytes on 64-bit platforms) instead of the element count MAX_OID_SZ (32), causing the function to accept crafted OIDs with 33 or more arcs that write past the end of the allocated buffer.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.23 | wolfssl | 5.9.1-r0 | ALPINE-CVE-2026-5187 |
| Alpine:v3.24 | wolfssl | 5.9.1-r0 | ALPINE-CVE-2026-5187 |
| Debian:12 | wolfssl | no fix listed | DEBIAN-CVE-2026-5187 |
| Debian:13 | wolfssl | no fix listed | DEBIAN-CVE-2026-5187 |
| Ubuntu:22.04:LTS | wolfssl | no fix listed | UBUNTU-CVE-2026-5187 |
| Ubuntu:24.04:LTS | wolfssl | no fix listed | UBUNTU-CVE-2026-5187 |
| Ubuntu:25.10 | wolfssl | no fix listed | UBUNTU-CVE-2026-5187 |
| Ubuntu:26.04:LTS | wolfssl | no fix listed | UBUNTU-CVE-2026-5187 |
| Ubuntu:26.10 | wolfssl | no fix listed | UBUNTU-CVE-2026-5187 |
Affected products (as reported)
Weakness: CWE-122, CWE-787 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N