In the TLSX_EchChangeSNI routine, the library fails to check the result of TLSX_Find before assigning extensions, which allows an attacker to inject a crafted SNI value that is attached to the shared context. The routine then writes 255 bytes beyond an allocated buffer during the SNI write phase, creating an out‑of‑bounds write that can corrupt memory and potentially allow remote code execution or cause a crash. The vulnerability is a classic buffer overflow (CWE‑787).

The flaw affects the wolfSSL cryptographic library, specifically the TLSECHChangeSNI implementation. No specific version numbers were supplied in the advisory, so any build that includes the unpatched TLSX_EchChangeSNI code is potentially vulnerable.

The CVSS score of 6.9 indicates moderate severity, and the advisory notes the vulnerability has not been reported in the CISA KEV catalog, suggesting no confirmed exploitation yet. However, because the flaw can be triggered by a crafted ClientHello message on the network, the attack vector is inferred as remote. An attacker would need to communicate with the vulnerable server over TLS to send the malformed message, a requirement that is readily met by a network attacker targeting a publicly exposed service that uses wolfSSL.