CVE-2023-6936

What it actually does

Buffer over-read of 5 bytes on the heap when WOLFSSL_CALLBACKS debugging flag is enabled, reachable via crafted TLS client handshake or network traffic.

Why it matters to the business

Limited risk of minor information disclosure in debugging-enabled wolfSSL builds; low urgency given stable low exploit probability and no known campaigns.

How an attack unfolds

Attacker connects with a malicious TLS client that forces the library to take the callback code path, causing a 5-byte heap over-read that leaks a small amount of adjacent memory.

How to fix it

Upgrade wolfSSL to version 5.6.6 or later (GIT commit 66596ad9e1d7efa8479656872cf09c9c1870a02e); disable WOLFSSL_CALLBACKS in production builds.

How to confirm the fix worked

Confirm wolfSSL version is 5.6.6 or newer; verify WOLFSSL_CALLBACKS is not defined in build configuration; run regression tests that exercise TLS handshake paths.

Typical attack path

1. Establish TLS connection to target using wolfSSL with WOLFSSL_CALLBACKS enabled
2. Send crafted ClientHello or handshake messages that exercise callback functions
3. Trigger the buffer over-read and capture the leaked 5 bytes from heap memory

How to detect it

Review TLS handshake logs and heap memory dumps around wolfSSL callback execution; no public exploitation artifacts are known.

What your security team should do

• Upgrade all wolfSSL instances to the fixed version immediately
• Audit build configurations to ensure WOLFSSL_CALLBACKS is disabled outside debugging environments
• Monitor for any future EPSS increases or KEV addition