A stack buffer overflow exists in the PKCS7 SignedData encoding routine of wolfSSL. In wc_PKCS7_BuildSignedAttributes() the code passes an incorrect capacity value (esd->signedAttribsCount) to EncodeAttributes() instead of the remaining space in the fixed-size signedAttribs[7] array. When an application supplies a signedAttribsSz that exceeds the allowed maximum, the function writes beyond the bounds of the local stack buffer, causing stack memory corruption. In builds configured for a small stack, this can become heap corruption. The overflow is classified as CWE‑121 and CWE‑787. The severity is low (CVSS 2.2) but the corruption may lead to program crashes or, potentially, arbitrary code execution if the overflow is exploited to hijack control flow – an inference drawn from typical consequences of such memory violations.

The vulnerability affects all releases of the wolfSSL library that include the PKCS7 signing functions and have not yet applied the patch introduced in pull request 9630. No specific version range is provided in the CVE data, so the risk applies to any pre‑patched build of wolfSSL.

The CVSS score is 2.2, indicating low severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires that an application accepts untrusted input that controls the signedAttribs array size when calling wc_PKCS7_EncodeSignedData() or related functions. Therefore the attack vector is application‑driven, contingent on handling of external attribute data. If such input is not validated, the attacker could trigger the overflow, potentially crashing the process or, less directly, using the memory corruption to influence program execution.