CVE-2026-5503

OVERVIEW CVE-2026-5503 is a memory corruption vulnerability in WolfSSL's TLS extension handling, specifically within the ECH (Encrypted Client Hello) implementation. The flaw occurs when the TLSX_EchChangeSNI function unconditionally sets extensions even when no inner SNI configuration exists, allowing an attacker to inject a malicious Server Name Indication that pollutes the shared SSL context. This subsequent memory misalignment causes a buffer overflow when the ClientHello is written, potentially affecting any application using the vulnerable WolfSSL library. SEVERITY While the precise CVSS vector is not available, the vulnerability represents a significant memory safety issue with a potential for remote code execution or denial of service. The attack requires network-accessible TLS communication but does not demand high complexity or user interaction. The FAUCET Risk Score of 36.0/100 indicates moderate concern, and the EPSS score of 0.00055 suggests current exploitation probability is low relative to other disclosed vulnerabilities. EXPLOITATION STATUS There is no evidence of active exploitation in the wild, and the vulnerability does not appear on the KEV Catalog or security community hot lists. This suggests limited current threat to production systems, though organizations running WolfSSL should still prioritize patching given the memory corruption nature of the flaw. No publicly available exploit code has been identified at this time.