Heap buffer overread in wc_PKCS7_DecodeEnvelopedData when parsing crafted PKCS7 EnvelopedData structures. This vulnerability could be triggered through attacker-supplied data delivered via S/MIME or CMS messages.
An unauthenticated attacker can send crafted S/MIME or CMS messages to trigger a heap buffer overread, potentially disclosing sensitive data from adjacent memory regions.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch information not available in provided data
Monitor for updates from wolfSSL regarding this vulnerability. Until a patch is available, review and restrict S/MIME and CMS message processing from untrusted sources. Consider implementing additional input validation on PKCS7 EnvelopedData structures before processing.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Feedly found the first article mentioning CVE-2026-6094 . See article
NVD published the first details for CVE-2026-6094
A CVSS base score of 6.3 has been assigned.
wolfssl ≤5.9.1-0.1 (Debian)
CVE-2026-6094 Heap buffer overread in wc_PKCS7_DecodeEnvelopedData when parsing crafted PKCS7 EnvelopedData. This could theoretically be triggered by attacker-supplied data delivered…
Collect, analyze, and vulnerability reports faster using AI
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
