CVE-2026-5448: 1-2 Byte Buffer Overflow in wolfSSL_X509_notAfter/notBefore

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-10 · updated 2026-06-17
Weakness: CWE-122

Description

X.509 date buffer overflow in wolfSSL_X509_notAfter / wolfSSL_X509_notBefore. A buffer overflow may occur when parsing date fields from a crafted X.509 certificate via the compatibility layer API. This is only triggered when calling these two APIs directly from an application, and does not affect TLS or certificate verify operations in wolfSSL.

Affected products

wolfSSL: before 5.9.1 — fixed in 5.9.1

How to fix

Upgrade to a fixed version: wolfSSL 5.9.1. Check the vendor advisory for mitigations.

References

https://github.com/wolfSSL/wolfssl/pull/10071

Get alerted when CVE-2026-5448 or the next vulnerability affects your stack