A heap out-of-bounds read occurs during parsing of PKCS7 SignedData in the wolfSSL library. A crafted PKCS7 message can trigger the missing bounds check in the indefinite-length end-of-content verification loop within PKCS7_VerifySignedData(), allowing an attacker to read arbitrary memory contents. This read can expose confidential data present on the host, constituting an information disclosure vulnerability classified as CWE-125.

The affected component is the wolfSSL cryptographic library. No specific version range is listed, which means that any build that contains the unchanged PKCS7 parsing logic may be susceptible. Users should verify whether their deployment incorporates the patch introduced in GitHub pull request 10039, which resolves the bounds check issue.

The CVSS score of 2.3 indicates a low severity impact. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited or no known active exploitation. Based on the fact that the flaw is triggered by processing a PKCS7 message, the likely attack vector involves supply of untrusted PKCS7 data, either remotely or locally, to an application that uses wolfSSL. Because the weakness only permits a memory read, it does not provide code execution or denial-of-service capabilities; therefore, the overall risk remains low.