Integer overflow in Wolfssl
CVE-2026-5477
An integer overflow existed in the wolfCrypt CMAC implementation, that could be exploited to forge CMAC tags. The function wc_CmacUpdate used the guard `if (cmac->totalSz != 0)` to skip XOR-chaining on the first block (where digest is all-…
Vulnerability class: Integer Overflow
EPSS: 0.000 (11.8th percentile) — read the EPSS interpretation.
Affected products
- Wolfssl — versions 0