CVE-2026-5187

CVE-2026-5187 is a critical heap buffer overflow vulnerability in WolfSSL's DecodeObjectId() function within wolfcrypt/src/asn.c. The flaw stems from two distinct input validation failures: inadequate bounds checking that permits a 2-byte out-of-bounds write when processing OID arc values, and caller functions that pass incorrect buffer size parameters, allowing crafted OIDs with 33 or more arcs to exceed allocated buffer boundaries. This vulnerability affects WolfSSL's ASN.1 parsing capabilities across multiple platforms where the library is integrated. The vulnerability carries a CVSS score of 9.8 (Critical) with network-based attack vector, no authentication required, and potential for complete compromise of confidentiality, integrity, and availability. An unauthenticated remote attacker can exploit this through specially crafted OID structures without user interaction, making the attack surface substantial in network-exposed applications. There is currently no evidence of active exploitation in the wild, and the vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog. However, the Active status on the Hot List and the relatively low EPSS score suggest the community is monitoring this issue closely. Organizations running WolfSSL should prioritize patching to prevent potential exploitation as awareness of this critical flaw increases.