Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.6

wolfCrypt: Potential Data Corruption in OID Decoding

published 3 months ago
Summary

The wolfCrypt library has a potential security issue that could allow an attacker to corrupt data when decoding Object Identifiers (OIDs). This could happen if an attacker provides a specially crafted OID. To fix this issue, update the wolfCrypt library to the latest version or apply the necessary patches to ensure that the bounds check is performed correctly and that the function only accepts valid OID lengths.

What to do
  • Update juliabinarywrappers wolfssl_jll to version 5.9.2+0.
Affected software
Ecosystem VendorProductAffected versions
Julia juliabinarywrappers wolfssl_jll < 5.9.2+0
Fix: upgrade to 5.9.2+0
Original advisory text
Two potential heap out-of-bounds write locations existed in DecodeObjectId() in `wolfcrypt/src/asn.c`. First, a bounds check only validates one available slot before writing two OID arc values (out...
Two potential heap out-of-bounds write locations existed in DecodeObjectId() in `wolfcrypt/src/asn.c`. First, a bounds check only validates one available slot before writing two OID arc values (out[0] and out[1]), enabling a 2-byte out-of-bounds write when outSz equals 1. Second, multiple callers pass sizeof(decOid) (64 bytes on 64-bit platforms) instead of the element count `MAX_OID_SZ` (32), causing the function to accept crafted OIDs with 33 or more arcs that write past the end of the allocated buffer.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.6 High
Timeline
Published14 Jul 2026
Updated28 Jul 2026
First seen14 Jul 2026
Sources
JLSEC-2026-714 · OSV
Track software like this
Free during beta