https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-12T19:48:27.419484+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-291193 EUVD-2026-291193 2026-10-12T19:48:27.434454+00:00 EUVD-2026-291193 https://cve.radiocsirt.org/vuln/fkie_cve-2026-5295 fkie_cve-2026-5295 2026-10-12T19:48:27.434486+00:00

A stack buffer overflow exists in wolfSSL's PKCS7 implementation in the wc_PKCS7_DecryptOri() function in wolfcrypt/src/pkcs7.c. When processing a CMS EnvelopedData message containing an OtherRecipientInfo (ORI) recipient, the function copies an ASN.1-parsed OID into a fixed 32-byte stack buffer (oriOID[MAX_OID_SZ]) via XMEMCPY without first validating that the parsed OID length does not exceed MAX_OID_SZ. A crafted CMS EnvelopedData message with an ORI recipient containing an OID longer than 32 bytes triggers a stack buffer overflow. Exploitation requires the library to be built with --enable-pkcs7 (disabled by default) and the application to have registered an ORI decrypt callback via wc_PKCS7_SetOriDecryptCb().

 https://cve.radiocsirt.org/vuln/ghsa-fgx8-q3cf-p457 GHSA-fgx8-q3cf-p457 2026-10-12T19:48:27.434525+00:00

A stack buffer overflow exists in wolfSSL's PKCS7 implementation in the wc_PKCS7_DecryptOri() function in wolfcrypt/src/pkcs7.c. When processing a CMS EnvelopedData message containing an OtherRecipientInfo (ORI) recipient, the function copies an ASN.1-parsed OID into a fixed 32-byte stack buffer (oriOID[MAX_OID_SZ]) via XMEMCPY without first validating that the parsed OID length does not exceed MAX_OID_SZ. A crafted CMS EnvelopedData message with an ORI recipient containing an OID longer than 32 bytes triggers a stack buffer overflow. Exploitation requires the library to be built with --enable-pkcs7 (disabled by default) and the application to have registered an ORI decrypt callback via wc_PKCS7_SetOriDecryptCb().

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-5295 msrc_CVE-2026-5295 — Stack Buffer Overflow in wolfSSL PKCS7 wc_PKCS7_DecryptOri() via Oversized OID 2026-10-12T19:48:27.434548+00:00 msrc_CVE-2026-5295 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-5295 UBUNTU-CVE-2026-5295 2026-10-12T19:48:27.434565+00:00

Affected: Ubuntu:16.04:LTS: wolfssl, Ubuntu:18.04:LTS: wolfssl, Ubuntu:20.04:LTS: wolfssl, Ubuntu:22.04:LTS: wolfssl, Ubuntu:24.04:LTS: wolfssl, Ubuntu:25.10: wolfssl, Ubuntu:26.04:LTS: wolfssl

A stack buffer overflow exists in wolfSSL's PKCS7 implementation in the wc_PKCS7_DecryptOri() function in wolfcrypt/src/pkcs7.c. When processing a CMS EnvelopedData message containing an OtherRecipientInfo (ORI) recipient, the function copies an ASN.1-parsed OID into a fixed 32-byte stack buffer (oriOID[MAX_OID_SZ]) via XMEMCPY without first validating that the parsed OID length does not exceed MAX_OID_SZ. A crafted CMS EnvelopedData message with an ORI recipient containing an OID longer than 32 bytes triggers a stack buffer overflow. Exploitation requires the library to be built with --enable-pkcs7 (disabled by default) and the application to have registered an ORI decrypt callback via wc_PKCS7_SetOriDecryptCb().