The vulnerability is a heap buffer overread in the wc_PKCS7_DecodeEnvelopedData function used by the wolfSSL library. When an attacker supplies crafted PKCS7 EnvelopedData, the function can read beyond the allocated buffer, potentially exposing data stored on the heap. This could lead to the corruption of sensitive information or local information exposure, though it does not provide code execution.

The affected product is the wolfSSL library. Vendor: wolfSSL. No specific version range is provided in the advisory.

The CVSS score of 6.3 indicates moderate severity. The EPSS score is not available, so the commonly observed exploitation probability is unclear. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to supply a malicious PKCS7 message, typically via S/MIME or CMS, to trigger the overread. Once the function parses the data, the overread could reveal sensitive information, but no remote code execution is described.