An out‑of‑bounds read can occur in wolfSSL during the TLS 1.3 CertificateVerify step when dual‑algorithm certificates are enabled. Crafted input to the certificate verification routine is able to cause the library to read beyond the intended buffer, which could expose arbitrary data from memory. The description does not mention any denial of service or code execution; the primary impact is the potential disclosure of sensitive information.

The vulnerable code exists in wolfSSL builds that enable experimental features and dual‑algorithm certificate support through the compiler flags --enable-experimental and --enable-dual-alg-certs. No specific version numbers are listed, so any build that incorporates those flags may be vulnerable.

The CVSS score of 6.3 indicates moderate severity, and no EPSS data is available; the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, through a malicious TLS 1.3 handshake that sends a crafted CertificateVerify message. This inference is made because the flaw is triggered by specially crafted input and requires the library to process that input, which typically occurs during a TLS connection. Exploitation would need a target that is using a wolfSSL build with the vulnerable options enabled, which limits widespread attack potential but still warrants immediate attention.