ANT-2026-87DJGDRB · wolfssl/wolfssl

heap-buffer-overflow low

CVE-2026-12340 GHSA-q349-x427-xg3w

Severity Claude high · Security research firm high · Maintainer low

Discovered by Claude Mythos Preview

REPORT

Anthropic's analysis of this finding, sealed at approval.

ANT-2026-87DJGDRB: Heap-buffer-overflow in sha.c:733

When wc_PKCS7_InitWithCert is given an attacker-supplied certificate buffer, ParseCertRelative calls CalcHashId_ex to hash certificate data, which reaches wc_ShaUpdate. With a crafted short input, wc_ShaUpdate performs a 64-byte memcpy that reads past the end of the 8-byte input allocation. The attacker controls the certificate bytes and length supplied to the PKCS#7 API. The result is an out-of-bounds heap read that could disclose adjacent heap memory or crash the process.

Target

Project: wolfSSL
Location: sha.c:733

Technical Details

ASAN: "READ of size 64 at 0x704ffcee0058 ... 0 bytes after 8-byte region". During certificate parsing, CalcHashId_ex passes a buffer/length derived from the malformed DER to wc_ShaHash → wc_ShaUpdate, which copies a full 64-byte SHA block without ensuring that many bytes remain in the source buffer, reading beyond the allocation.

Crash trace (truncated — full trace in attached crash.log):

INFO: Running with entropic power schedule (0xFF, 100).
INFO: Seed: 2781334584
INFO: Loaded 1 modules   (77873 inline 8-bit counters): 77873 [0x622b0ccbf5d8, 0x622b0ccd2609), 
INFO: Loaded 1 PC tables (77873 PCs): 77873 [0x622b0ccd2610,0x622b0ce02920), 
/out/fuzzer-wolfssl-misc: Running 1 inputs 1 time(s) each.
Running: /tmp/poc
EXIT_CODE:1


=== ASAN Report ===
=================================================================
==28==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x704ffcee0058 at pc 0x622b0c6cf4ab bp 0x7ffece072150 sp 0x7ffece071910
READ of size 64 at 0x704ffcee0058 thread T0
    #0 0x622b0c6cf4aa in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:63:3
    #1 0x622b0ca76fcf in wc_ShaUpdate /src/wolf-ssl-ssh-fuzzers/oss-fuzz/projects/wolf-ssl-ssh/fuzzers/wolfssl/wolfssl/wolfcrypt/src/sha.c:733:13
    #2 0x622b0ca0217e in wc_ShaHash_ex /src/wolf-ssl-ssh-fuzzers/oss-fuzz/projects/wolf-ssl-ssh/fuzzers/wolfssl/wolfssl/wolfcrypt/src/hash.c:1381:24
    #3 0x622b0ca0217e in wc_ShaHash /src/wolf-ssl-ssh-fuzzers/oss-fuzz/projects/wolf-ssl-ssh/fuzzers/wolfssl/wolfssl/wolfcrypt/src/hash.c:1403:16
    #4 0x622b0c751247 in CalcHashId_ex /src/wolf-ssl-ssh-fuzzers/oss-fuzz/projects/wolf-ssl-ssh/fuzzers/wolfssl/wolfssl/wolfcrypt/src/asn.c:14544:15
    #5 0x622b0c751247 in ParseCertRelative /src/wolf-ssl-ssh-fuzzers/oss-fuzz/projects/wolf-ssl-ssh/fuzzers/wolfssl/wolfssl/wolfcrypt/src/asn.c
    #6 0x622b0c750122 in ParseCert /src/wolf-ssl-ssh-fuzzers/oss-fuzz/projects/wolf-ssl-ssh/fuzzers/wolfssl/wolfssl/wolfcrypt/src/asn.c:24900:11
    #7 0x622b0c7d6934 in wc_PKCS7_InitWithCert /src/wolf-ssl-ssh-fuzzers/oss-fuzz/projects/wolf-ssl-ssh/fuzzers/wolfssl/wolfssl/wolfcrypt/src/pkcs7.c:1173:15
    [... 12 more frames — full trace in crash.log]

Reproduction

Craft a short/malformed DER certificate buffer
Supply it to wc_PKCS7_InitWithCert()
ParseCertRelative → CalcHashId_ex → wc_ShaHash → wc_ShaUpdate memcpy reads 64 bytes past the buffer end

[No reproducer or sanitizer output attached — request from security-cvd@anthropic.com if needed.]

Acknowledgement

This vulnerability was discovered by Claude, Anthropic's AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research. Please direct questions to security-cvd@anthropic.com and reference ANT-2026-87DJGDRB.

Reference: ANT-2026-87DJGDRB
Anthropic CVD Policy: https://www.anthropic.com/coordinated-vulnerability-disclosure

SECURITY RESEARCH FIRM ANALYSIS

Independent triage by an external party.

Verdict: true positive
Severity: high

UPSTREAM FIX

The change that resolved this finding.

diff --git a/wolfcrypt/src/asn.c b/wolfcrypt/src/asn.c
index 00be607506c..664d7862f5b 100644
--- a/wolfcrypt/src/asn.c
+++ b/wolfcrypt/src/asn.c
@@ -23380,6 +23380,10 @@ int ParseCertRelative(DecodedCert* cert, int type, int verify, void* cm,
         if (cert->extSubjKeyIdSet == 0 && cert->publicKey != NULL &&
                                                          cert->pubKeySize > 0) {
             if (cert->signatureOID == CTC_SM3wSM2) {
+                if (cert->pubKeySize < 65) {
+                    WOLFSSL_ERROR_VERBOSE(BUFFER_E);
+                    return BUFFER_E;
+                }
                 /* TODO: GmSSL creates IDs this way but whole public key info
                  * block should be hashed. */
                 ret = CalcHashId_ex(cert->publicKey + cert->pubKeySize - 65, 65,

https://github.com/wolfSSL/wolfssl/commit/6bfb53f084a25198835a50796eca83f463a0e7be

ADVISORY

https://github.com/wolfSSL/wolfssl/pull/10641

TIMELINE

Dates from discovery through public reveal.

2026-03-24 Reported to tracker
2026-03-26 Sent to maintainer
2026-03-26 Maintainer acknowledged
2026-06-24 Patch released
2026-08-17 Publicly revealed

PROVENANCE

SHA-3-512 hash:

f35e4f410ec58dab28431670e173e03fd1e5105f8afefc79c7edd5117d684d3aa377d218762d2f1ab70c6262e31227885bacaf2062958b077e305e5aebc6c37d

Committed 2026-05-17 20:27 PT

Revealed 2026-08-17 10:47 PT

Verify (download preimage.json)

Show preimage JSON

{
  "ant_id": "ANT-2026-87DJGDRB",
  "bug_class": "Heap-buffer-overflow",
  "claude_severity": "high",
  "commit_sha": null,
  "created_at": "2026-03-24T18:46:56+00:00",
  "description": "When wc_PKCS7_InitWithCert is given an attacker-supplied certificate buffer, ParseCertRelative calls CalcHashId_ex to hash certificate data, which reaches wc_ShaUpdate. With a crafted short input, wc_ShaUpdate performs a 64-byte memcpy that reads past the end of the 8-byte input allocation. The attacker controls the certificate bytes and length supplied to the PKCS#7 API. The result is an out-of-bounds heap read that could disclose adjacent heap memory or crash the process.",
  "discovered_at": null,
  "location": "sha.c:733",
  "poc_sha256": null,
  "preimage_version": 1,
  "project": "wolfssl",
  "reproduction": [
    "1. Craft a short/malformed DER certificate buffer",
    "2. Supply it to wc_PKCS7_InitWithCert()",
    "3. ParseCertRelative → CalcHashId_ex → wc_ShaHash → wc_ShaUpdate memcpy reads 64 bytes past the buffer end"
  ],
  "technical_details": "ASAN: \"READ of size 64 at 0x704ffcee0058 ... 0 bytes after 8-byte region\". During certificate parsing, CalcHashId_ex passes a buffer/length derived from the malformed DER to wc_ShaHash → wc_ShaUpdate, which copies a full 64-byte SHA block without ensuring that many bytes remain in the source buffer, reading beyond the allocation.",
  "title": "Heap-buffer-overflow in sha.c:733",
  "vendor_severity": null
}