Description
Heap buffer overflow in DTLS 1.3 ACK message processing. A remote attacker can send a crafted DTLS 1.3 ACK message that triggers a heap buffer overflow.
Published: 2026-04-09
Score: 8.3 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution via Heap Buffer Overflow
Action: Immediate Patch
AI Analysis

Impact

A heap buffer overflow occurs during DTLS 1.3 ACK message processing. The flaw allows a remote participant to send a specially crafted ACK packet that overwrites memory on the heap, potentially enabling arbitrary code execution or processes to crash. The weakness is classified as CWE‑122, indicating a classic heap overflow.

Affected Systems

The vulnerability affects the wolfSSL library as distributed by wolfSSL. No specific product version is listed, but all builds handling DTLS 1.3 are potentially impacted until a patched release is available.

Risk and Exploitability

The CVSS score of 8.3 shows high severity. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is remote; an adversary must reach the DTLS endpoint and send a crafted ACK message. No further prerequisites are stated, implying the vulnerability is exploitable in standard use scenarios.

Generated by OpenCVE AI on April 9, 2026 at 23:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest wolfSSL version that includes the DTLS 1.3 ACK overflow fix.
  • If an upgrade is not immediately possible, isolate or harden affected services to block inbound DTLS traffic until a patch can be applied.
  • Monitor network traffic for anomalous DTLS ACK packets and report any suspicious activity to the security team.

Generated by OpenCVE AI on April 9, 2026 at 23:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 29 Apr 2026 17:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:wolfssl:wolfssl:*:*:*:*:*:*:*:*
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Fri, 10 Apr 2026 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 10 Apr 2026 09:00:00 +0000

Type Values Removed Values Added
First Time appeared Wolfssl
Wolfssl wolfssl
Vendors & Products Wolfssl
Wolfssl wolfssl

Thu, 09 Apr 2026 22:00:00 +0000

Type Values Removed Values Added
Description Heap buffer overflow in DTLS 1.3 ACK message processing. A remote attacker can send a crafted DTLS 1.3 ACK message that triggers a heap buffer overflow.
Title DTLS 1.3 ACK heap buffer overflow
Weaknesses CWE-122
References
Metrics cvssV4_0

{'score': 8.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Wolfssl Wolfssl
cve-icon MITRE

Status: PUBLISHED

Assigner: wolfSSL

Published:

Updated: 2026-04-10T13:55:41.431Z

Reserved: 2026-03-31T16:56:10.370Z

Link: CVE-2026-5264

cve-icon Vulnrichment

Updated: 2026-04-10T13:55:38.517Z

cve-icon NVD

Status : Analyzed

Published: 2026-04-09T22:16:36.790

Modified: 2026-04-29T17:18:21.633

Link: CVE-2026-5264

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-10T09:27:44Z

Weaknesses