A heap-based buffer overflow exists in the wc_ecc_import_x963_ex function of wolfSSL’s KCAPI ECC path. When a malicious TLS peer sends an oversized EC public key point, the code copies the input to the 132‑byte pubkey_raw buffer using XMEMCPY without validating the length. This allows attacker‑controlled data to be written past the buffer boundary, which can corrupt memory and may enable arbitrary code execution or denial of service. The flaw is identified as CWE‑122, a classic heap corruption weakness.

The vulnerability affects the wolfSSL library for all platforms where the WOLFSSL_KCAPI_ECC path is compiled, which includes generic wolfSSL builds. The patch that resolves the issue is contained in the pull request referenced by the CVE; updating to the wolfSSL version that incorporates PR #9988 will remove the unsafe copy. If a project is using WOLFSSL_KCAPI_ECC, it must ensure it is disabled or upgraded. No specific version numbers are listed in the CNA data, so any build before the patch is potentially vulnerable.

The CVSS score is 1.3, indicating a low severity assessment, and the EPSS score is less than 1 %, suggesting that exploitation is currently unlikely. The vulnerability is not recorded in the NASA KEV catalog. Attackers would need to initiate a TLS handshake with a client that supports the KCAPI ECC path; the overflow would occur during the ServerKeyExchange message. While the path is typically not enabled by default, the combination of a rare code path and low exploitation probability lowers the overall risk, although the potential impact if exploited is significant.