critical9.1
CVE-2026-6094
Heap buffer overread in wc_PKCS7_DecodeEnvelopedData when parsing crafted PKCS7 EnvelopedData.
Impact
Heap buffer overread in wc_PKCS7_DecodeEnvelopedData when parsing crafted PKCS7 EnvelopedData. This could theoretically be triggered by attacker-supplied data delivered via S/MIME or CMS.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Wolfssl | Wolfssl | from 5.8.0 before 5.9.2 |