An integer overflow in the wolfCrypt CMAC implementation causes the XOR‑chaining guard to be skipped after 4 GiB of processed data. This produces identical CMAC tags for messages that share a common suffix beyond that boundary, allowing an attacker to forge a CMAC for a malicious message with a different prefix. The flaw is an integer overflow (CWE‑190) that enables bypass of authentication and can be used to manipulate or impersonate verified data.

The vulnerability is present in the wolfSSL wolfCrypt CMAC component. Affected vendor is wolfSSL. No specific version information is provided in the advisory; the issue exists in all releases that include the flawed wc_CmacUpdate guard.

With a CVSS score of 8.2 the vulnerability is high severity. EPSS information is not available and it is not listed in the CISA KEV catalog. Exploitation requires processing over four gigabytes of data to wrap the 32‑bit counter, so it is likely relevant to applications handling very large streams or files. When exploited, an attacker can forge CMAC tags and authenticate malicious messages, compromising data integrity and potentially enabling further attacks.