A padding oracle vulnerability exists in wolfSSL’s handling of PKCS#7 EnvelopedData when using RSA PKCS#1 v1.5 key transport. The implementation returns distinguishable error codes for padding‑validation failures versus other decryption errors, allowing an attacker to infer the validity of each guessed byte of the encrypted Content Encryption Key (CEK). By repeatedly sending crafted EnvelopedData messages to a system that performs such decryption, the attacker can gradually recover the CEK and subsequently decrypt the protected message contents. The weakness is classified as CWE‑208, information exposure through invalid error messages.

The affected product is wolfSSL. No specific version information is supplied in the listed data; therefore any installation of wolfSSL that performs PKCS#7 EnvelopedData decryption using RSA PKCS#1 v1.5 may be vulnerable unless patched.

The CVSS score of 6 indicates medium severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, so the current public exploit evidence is limited. Nevertheless, the flaw can be exploited remotely if an application processes user‑supplied EnvelopedData and discloses distinct error paths. An attacker who can observe error responses can use the oracle to recover the CEK; the determination of the CVSS score reflects the confidentiality impact and the feasibility of the attack under normal network conditions. The patch mitigates the issue by generating deterministic faux keys and ensuring constant‑time error handling, so the risk diminishes after applying the fix.