Critical severity9.1NVD Advisory· Published Apr 10, 2026· Updated Apr 29, 2026

CVE-2026-5393

Description

Dual-Algorithm CertificateVerify out-of-bounds read. When processing a dual-algorithm CertificateVerify message, an out-of-bounds read can occur on crafted input. This can only occur when --enable-experimental and --enable-dual-alg-certs is used when building wolfSSL.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WolfSSL/Wolfssl2 versions
cpe:2.3:a:wolfssl:wolfssl:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:wolfssl:wolfssl:*:*:*:*:*:*:*:*range: <5.9.1
- (no CPE)

Patches

Vulnerability mechanics

References

github.com/wolfSSL/wolfssl/pull/10079nvdIssue TrackingPatch

News mentions

No linked articles in our index yet.

Severity

CriticalCVSS v3.1

9.1/ 10

CVSS v46.3

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack vector: Network
Complexity: Low
Privileges: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: High

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

EPSS

Probability of exploitation in the next 30 days.

0.19%

VYPR risk score

Composite of severity, exploitation, and reach.

0.52high

cvss	0.591
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000

Weaknesses

CWE-125
Out-of-bounds Read

CVE ID

CVE-2026-5393

Credits

SY
Seunghyun Yoon, (Korea Institute of Energy Technology, KENTECH) for testing
other
SL
Sunwoo Lee, (Korea Institute of Energy Technology, KENTECH) for testing
other
WC
Woohyun Choi, (Korea Institute of Energy Technology, KENTECH) for testing
other