A buffer overflow occurs in tsip_StoreMessage() within wolfSSL’s Renesas TSIP TLS implementation when the TLS 1.3 handshake transcript grows beyond the fixed 8 KB buffer. The excess data is copied to memory that has already been allocated for the buffer, corrupting adjacent heap objects and causing the client process to crash. This results in a remote denial‑of‑service of the TLS 1.3 client side, since no authentication or validation of the overflow is performed.

wolfSSL firmware that compiles the Renesas TSIP TLS port (WOLFSSL_RENESAS_TSIP_TLS) as a TLS 1.3 client on Renesas microcontrollers with TSIP hardware enabled is affected. All other wolfSSL builds, non‑TSIP configurations, or server roles are not impacted.

The CVSS score of 8.3 reflects a high impact. No EPSS data is available and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector requires a remote adversary to supply a TLS 1.3 handshake containing an unusually large or malicious certificate chain or an oversized handshake message to a client that does not enforce strict chain size limits. Once the overflow occurs, heap corruption leads to a crash, providing a straightforward denial‑of‑service attack path.