The vulnerability allows an attacker to forge a cryptographic signature by submitting a zero-length or otherwise truncated HMAC tag that is erroneously accepted as valid during EVP_DigestVerifyFinal verification. As a result, an attacker could have a message falsely authenticated, effectively bypassing integrity checks that rely on HMAC verification. This weaknesses is identified as CWE-347, indicating a failure to properly enforce cryptographic checks. The impact is limited to the integrity of data protected by this verification path, and does not expose confidentiality directly.

The affected product is wolfSSL, as noted by the CNA vendor/product name. No specific versions are listed in the CNA data, so it is necessary to review the release notes of wolfSSL or consult the vendor for the relevant range affected by the bug.

The CVSS score of 2.1 indicates a very low overall severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting a low likelihood of widespread exploitation at the present time. The most probable attack vector is the provision of a forged signature or HMAC tag to the application. Based on the description, it is inferred that the flaw could be exploited remotely or locally by any entity that can supply input to the HMAC verification routine. However, exploitation requires the attacker to control or influence the signature data, which may limit the attack surface.