A one‑byte stack buffer over‑read occurs in the MatchDomainName function during wildcard hostname validation when the LEFT_MOST_WILDCARD_ONLY flag is active. The function reads one byte beyond the hostname buffer if a leading wildcard consumes the entire string, leading to an out‑of‑bounds read that can trigger a crash. This type of error is a Stack Buffer Over‑Read (CWE‑126) and results in untrusted input causing a denial of service by terminating the process.

The vulnerability affects the wolfSSL cryptographic library, specifically the hostname validation code in src/internal.c. No specific product version is listed in the advisory, but the issue exists in releases of wolfSSL that contain the described function and flag handling. Any deployment that links against an affected build of wolfSSL and performs wildcard hostname validation is at risk.

The CVSS score of 2.1 indicates low severity. Since EPSS data is unavailable and the vulnerability is not in the KEV catalog, the likelihood of widespread exploitation appears limited. Nevertheless, an attacker who can control or influence the hostname string validated by wolfSSL could trigger a crash by crafting a name that fully matches a leading wildcard when the LEFT_MOST_WILDCARD_ONLY flag is enabled. Because the impact is service interruption rather than data theft, the risk is primarily operational.