CVE-2026-5500

OVERVIEW CVE-2026-5500 is a cryptographic validation flaw in wolfSSL's wc_PKCS7_DecodeAuthEnvelopedData() function that fails to properly validate the AES-GCM authentication tag length during PKCS#7 authenticated envelope decoding. The vulnerability allows attackers to manipulate the MAC field length without proper bounds checking. SEVERITY The vulnerability presents a moderate risk with a FAUCET Risk Score of 51.0/100. An unauthenticated man-in-the-middle attacker can truncate the AES-GCM authentication tag from the standard 16 bytes down to 1 byte, substantially weakening cryptographic security from 2^-128 odds of successful forgery to 2^-8 odds. This represents a significant reduction in authentication strength that could enable message tampering and forgery attacks. The EPSS score of 0.00142 indicates this vulnerability is currently exploited less frequently than most CVEs. EXPLOITATION STATUS There is no current evidence of active exploitation in the wild. The vulnerability is not tracked on the CISA Known Exploited Vulnerabilities (KEV) catalog and remains classified as inactive on threat tracking lists. No public exploit code availability is documented. Community attention remains limited given the specialized nature of the affected cryptographic function and wolfSSL's customer base.