ANT-2026-JS5D1Z2X · wolfssl/wolfssl

buffer-overflow medium

CVE-2026-5295 CVE-2026-6678

Severity Claude high · Security research firm high · Maintainer medium

Discovered by Claude Mythos Preview

REPORT

Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Calif.

ANT-2026-JS5D1Z2X: Stack buffer overflow in PKCS#7 OtherRecipientInfo OID copy

In wc_PKCS7_DecryptOri(), the 32-byte stack array oriOID[MAX_OID_SZ] is populated with XMEMCPY(oriOID, pkiMsg + *idx, oriOIDSz). oriOIDSz is obtained from GetASNObjectId(), which bounds it only against the remaining message length, not MAX_OID_SZ. An attacker supplying an EnvelopedData whose [4] OtherRecipientInfo contains an OBJECT IDENTIFIER with encoded length >32 overflows the stack with controlled bytes. The path is reachable from the public wc_PKCS7_DecodeEnvelopedData()/wc_PKCS7_DecodeAuthEnvelopedData() APIs when the application has registered an ORI callback. A secondary word32 underflow of oriValueSz at line 11515 compounds the issue.

Target

Project: wolfssl/wolfssl
Location: wolfcrypt/src/pkcs7.c:11507
Discovery: static analysis — not yet dynamically reproduced

Technical Details

GetASNObjectId → GetASNHeader → GetLength_ex only checks idx + length > maxIdx (remaining input), and the ASN_OBJECT_ID path enforces only a 3-byte minimum — there is no cap at MAX_OID_SZ (32). The decoded length is then used directly as the XMEMCPY size into a 32-byte stack local, so any OID TLV with length >32 writes attacker-controlled bytes past the buffer and over saved registers/return address.

Reproduction

Craft a CMS EnvelopedData (or AuthEnvelopedData) message containing a RecipientInfo with CHOICE tag [4] (OtherRecipientInfo).
Encode the oriType OBJECT IDENTIFIER with a DER length greater than 32 (e.g., 200 bytes of attacker-chosen content).
Deliver the message to the victim application, which calls wc_PKCS7_DecodeEnvelopedData().
Parsing reaches wc_PKCS7_DecryptOri(); GetASNObjectId() returns oriOIDSz=200.
XMEMCPY writes 200 attacker-controlled bytes into the 32-byte stack array, overwriting saved registers / return address.

[No reproducer or sanitizer output attached — request from security-cvd@anthropic.com if needed.]

Suggested Fix

Bound oriOIDSz against MAX_OID_SZ (the destination buffer size) before the XMEMCPY, rejecting or truncating any OID whose encoded length exceeds it; also validate that (*idx - tmpIdx) <= seqSz before computing oriValueSz to prevent the word32 underflow.

Acknowledgement

This vulnerability was discovered by Claude, Anthropic's AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research. Please direct questions to security-cvd@anthropic.com and reference ANT-2026-JS5D1Z2X.

Reference: ANT-2026-JS5D1Z2X
Anthropic CVD Policy: https://www.anthropic.com/coordinated-vulnerability-disclosure

SECURITY RESEARCH FIRM ANALYSIS

Triage and disclosure were performed by Calif.

Verdict: true positive
Severity: high

TIMELINE

Dates from discovery through public reveal.

2026-04-16 Reported to tracker
2026-05-28 Sent to maintainer
2026-05-28 Patch released
2026-05-28 Maintainer acknowledged
2026-05-28 Publicly revealed

PROVENANCE

SHA-3-512 hash:

6fb8b908f6dd4779d30612aab9dd3e34fc1d4f82a937a110480b5c8ee9bc3e3ffbf38a24be20d73810e6c0fd05385ed4cff98c7fd74d654488dd017e5308a2c9

Committed 2026-05-28 08:10 PT

Revealed 2026-05-28 11:00 PT

Verify (download preimage.json)

Show preimage JSON

{
  "ant_id": "ANT-2026-JS5D1Z2X",
  "bug_class": "Buffer Overflow",
  "claude_severity": "high",
  "commit_sha": null,
  "created_at": "2026-04-16T14:11:51+00:00",
  "description": "In wc_PKCS7_DecryptOri(), the 32-byte stack array `oriOID[MAX_OID_SZ]` is populated with `XMEMCPY(oriOID, pkiMsg + *idx, oriOIDSz)`. `oriOIDSz` is obtained from GetASNObjectId(), which bounds it only against the remaining message length, not MAX_OID_SZ. An attacker supplying an EnvelopedData whose [4] OtherRecipientInfo contains an OBJECT IDENTIFIER with encoded length >32 overflows the stack with controlled bytes. The path is reachable from the public wc_PKCS7_DecodeEnvelopedData()/wc_PKCS7_DecodeAuthEnvelopedData() APIs when the application has registered an ORI callback. A secondary word32 underflow of `oriValueSz` at line 11515 compounds the issue.",
  "discovered_at": "2026-04-02T00:00:00+00:00",
  "location": "wolfcrypt/src/pkcs7.c:11507",
  "poc_sha256": null,
  "preimage_version": 1,
  "project": "wolfSSL/wolfssl",
  "reproduction": [
    "1. Craft a CMS EnvelopedData (or AuthEnvelopedData) message containing a RecipientInfo with CHOICE tag [4] (OtherRecipientInfo).",
    "2. Encode the oriType OBJECT IDENTIFIER with a DER length greater than 32 (e.g., 200 bytes of attacker-chosen content).",
    "3. Deliver the message to the victim application, which calls wc_PKCS7_DecodeEnvelopedData().",
    "4. Parsing reaches wc_PKCS7_DecryptOri(); GetASNObjectId() returns oriOIDSz=200.",
    "5. XMEMCPY writes 200 attacker-controlled bytes into the 32-byte stack array, overwriting saved registers / return address."
  ],
  "technical_details": "GetASNObjectId → GetASNHeader → GetLength_ex only checks `idx + length > maxIdx` (remaining input), and the ASN_OBJECT_ID path enforces only a 3-byte minimum — there is no cap at MAX_OID_SZ (32). The decoded length is then used directly as the XMEMCPY size into a 32-byte stack local, so any OID TLV with length >32 writes attacker-controlled bytes past the buffer and over saved registers/return address.",
  "title": "Stack buffer overflow in PKCS#7 OtherRecipientInfo OID copy",
  "vendor_severity": "high"
}