CVE-2026-5504

OVERVIEW CVE-2026-5504 is a padding oracle vulnerability in wolfSSL's PKCS7 CBC decryption implementation. The flaw exists because interior padding bytes are not properly validated during decryption operations, allowing attackers to recover plaintext data through repeated decryption queries with modified ciphertext. SEVERITY The vulnerability requires an attacker to have direct access to perform repeated decryption queries against the affected system, indicating an attack complexity that is not trivial. While specific CVSS metrics are not available, the EPSS score of 0.00025 indicates this vulnerability has exceptionally low predicted exploitation probability. The potential impact is confidentiality breach through plaintext recovery, though the practical risk appears limited by access requirements and exploitation difficulty. EXPLOITATION STATUS There is no evidence of active exploitation in the wild, as the vulnerability is not listed on the Known Exploited Vulnerabilities catalog. The FAUCET Risk Score of 35.0 out of 100 further suggests low current threat activity. The vulnerability remains inactive on security hotlists, and no public exploit code availability has been reported, indicating minimal community attention to date.