A stack buffer overflow exists in the PKCS7 decryption routine of the wolfSSL library. When a CMS EnvelopedData message contains an OtherRecipientInfo (ORI) entry with an object identifier longer than 32 bytes, the library copies the ASN.1‑parsed OID into a 32‑byte stack buffer without bounds checking. This overflow can corrupt the stack and potentially allow an attacker to execute arbitrary code or crash the application, compromising confidentiality, integrity, and availability.

Affected systems are applications that link against wolfSSL and have PKCS#7 support enabled (the optional --enable-pkcs7 flag). The vulnerability only manifests if the application has registered an ORI decrypt callback via wc_PKCS7_SetOriDecryptCb(). The specific version ranges are not listed, so any build that satisfies these conditions prior to the fix is at risk.

The severity is classified as a CVSS score of 5.9, indicating moderate risk. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation may not have been observed yet. The required preconditions—building the library with PKCS#7 enabled and registering a callback—raise the complexity, but once those are in place, exploiting the overflow is feasible. Organizations should treat this as a potential code‑execution risk and apply the fix promptly.