Two buffer overflows exist in wolfSSL's CRL parser when processing CRL numbers: a heap‑based overflow occurs when the CRL number is stored as a hexadecimal string incorrectly, and a stack‑based overflow can be triggered for sufficiently large CRL numbers. An attacker can supply a malicious CRL from an untrusted source to cause out‑of‑bounds writes, which could lead to arbitrary code execution or denial of service on the affected system. The weakness is characterized by CWE‑122 (Heap‑based Buffer Overflow) and CWE‑787 (Out‑Of‑Bounds Write).

The vulnerability affects the wolfSSL library (wolfSSL:wolfSSL). It only applies to builds that enable CRL support. No specific affected versions are listed in the CNA data, so version information is unknown. The vulnerability requires that the application loads a CRL from an untrusted source.

The CVSS score of 7.2 indicates a high severity. EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires delivery of a crafted CRL to a compatible application, which may be feasible in environments that accept external CRLs. The presence of a heap and stack buffer overflow means that an attacker with control over the CRL data could potentially achieve remote code execution, making the risk significant for applications that rely on wolfSSL with CRL support.