A stack buffer overflow occurs in the wc_HpkeLabeledExtract function of wolfSSL when it processes an oversized Encrypted Client Hello (ECH) configuration packet supplied by a TLS server. The flaw allows the attacker to execute arbitrary code or crash the client application, compromising confidentiality, integrity, and availability on the affected device. The vulnerability is triggered only if ECH is enabled, and the overflow happens on the client side during the extraction of HPKE parameters.

The affected package is wolfSSL Inc.'s wolfSSL library version 5.8.4, which implements ECH support. Any client that uses this library with the enable‑ech option set is vulnerable. Versions older than 5.8.4 or those patched after 5.8.4 are not affected.

The CVSS score of 6.9 indicates medium severity, while the EPSS score of less than 1 % suggests a low probability of active exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a malicious TLS server capable of sending an oversized ECH configuration; if the server is under the attacker’s control or the client accepts connections from untrusted parties, remote code execution or a client crash can result.