A crafted CMS EnvelopedData message containing zero‑length encrypted content triggers a 1‑byte out‑of‑bounds heap read in the wc_PKCS7_DecodeEnvelopedData function of the wolfSSL library. The read occurs because the function does not properly check bounds when processing the encrypted content. The resulting unwanted memory access may leak a single byte of data from the heap, potentially revealing sensitive information. This weakness is identified as CWE‑125 (Out‑of‑Bounds Read).

wolfSSL versions 5.8.4 and earlier contain the flaw. The vulnerability is present in builds where PKCS7 support is enabled, while the default configuration disables PKCS7. No other vendors or products are reported as affected.

The CVSS score of 1.2 indicates low severity, and there is no EPSS score or KEV listing, suggesting limited exploitation evidence. Exploitation requires an attacker to forge a CMS EnvelopedData message with zero‑length content, which would be processed by an application using the wolfSSL library. The primary risk is the disclosure of a small amount of memory data; the impact is therefore modest. The attack vector is likely local or via an application that accepts CMS data, and the exploitability is low due to the precise input required and the limited read length.