Cloudanix VulnDB

CVE-2026-5187

Critical · 9.8

CVSS

9.8

EPSS

0.5%

Published

Apr 9, 2026

CISA due date

—

The record

Two potential heap out-of-bounds write locations existed in DecodeObjectId() in wolfcrypt/src/asn.c. First, a bounds check only validates one available slot before writing two OID arc values (out[0] and out[1]), enabling a 2-byte out-of-bounds write when outSz equals 1. Second, multiple callers pass sizeof(decOid) (64 bytes on 64-bit platforms) instead of the element count MAX_OID_SZ (32), causing the function to accept crafted OIDs with 33 or more arcs that write past the end of the allocated buffer.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities