The vulnerability is an integer underflow that occurs inside the wc_PKCS7_DecryptOri routine when it processes a crafted Other Recipient Information block. This underflow results in an incorrect length calculation, which can cause the routine to read beyond the bounds of the provided buffer during decryption. The potential effect is memory mis‑reading or corruption that may lead to crashes or unpredictable program behavior. The exact conditions for exploitation are not detailed in the CVE data, but it is inferred that an attacker could supply a maliciously formatted PKCS#7 message to trigger the flaw.

The affected product is wolfSSL provided by wolfSSL. No specific vulnerable version range is listed in the evidence, so any installation that may use the vulnerable wc_PKCS7_DecryptOri function before the described patch could be at risk.

The CVSS score is 1, indicating a very low severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting that the likelihood of known exploitation is low. The probable attack vector involves sending a crafted PKCS#7 packet to a vulnerable application, but because the effect is primarily a potential crash or corruption, the overall risk remains low under current data.