A heap-buffer-overflow vulnerability exists in the wolfSSL library’s wolfSSL_d2i_SSL_SESSION() function when deserializing TLS session data that has SESSION_CERTS enabled. The function reads certificate and session‑id lengths from untrusted input without performing bounds validation, allowing a crafted session blob to overflow fixed‑size buffers and corrupt heap memory. This corruption could enable an attacker to alter program flow or cause a crash, thereby compromising the confidentiality, integrity, or availability of the affected application.

The vulnerability affects all products that include the wolfSSL library provided by the vendor wolfssl. No specific product or version information is supplied in the CVE data; therefore any instance that uses the library with SESSION_CERTS enabled is potentially exposed unless mitigated.

The CVSS score of 5 indicates a medium severity rating. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attacker must supply a malicious session file to a system that processes such data, making the likely attack vector remote or via a compromised input source. No public exploits are documented, but the flaw can be reproduced under the stated conditions, giving attackers the potential to destabilize or take control of the vulnerable application.