CVE-2026-0819: Stack buffer overflow in PKCS7 SignedData encoding with custom signed attributes

Vulnerability summary

CVE-2026-0819 is a high (CVSS 7.1) Stack-based Buffer Overflow vulnerability in wolfssl. EPSS estimates a 0.10% chance of exploitation in the next 30 days, higher than 0.9% of scored vulnerabilities.

Timeline

1. 19-03-2026
   PublishedVulnerability first disclosed.
2. 19-03-2026
   Last modifiedVulnerability information updated.

Description

A stack buffer overflow vulnerability exists in wolfSSL's PKCS7 SignedData encoding functionality. In wc_PKCS7_BuildSignedAttributes(), when adding custom signed attributes, the code passes an incorrect capacity value (esd->signedAttribsCount) to EncodeAttributes() instead of the remaining available space in the fixed-size signedAttribs[7] array. When an application sets pkcs7->signedAttribsSz to a value greater than MAX_SIGNED_ATTRIBS_SZ (default 7) minus the number of default attributes already added, EncodeAttributes() writes beyond the array bounds, causing stack memory corruption. In WOLFSSL_SMALL_STACK builds, this becomes heap corruption. Exploitation requires an application that allows untrusted input to control the signedAttribs array size when calling wc_PKCS7_EncodeSignedData() or related signing functions.

• CWE-121Stack-based Buffer OverflowThe product writes past the end of a buffer that was allocated on the stack.
• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.