The vulnerability allows the PKCS#7 decode routine to ignore the caller‑supplied buffer size, causing decoded content to be written beyond the bounds of the provided buffer. This buffer overflow is identified as CWE-120 and CWE-787, which can potentially lead to memory corruption and arbitrary code execution if an attacker can supply crafted PKCS#7 data.

wolfSSL libraries at version 5.9.0 and earlier are affected. The issue was remediated in the 5.9.1 release, so any installation using a pre‑5.9.1 build is at risk.

The CVSS score of 1 indicates a low severity impact; there is no EPSS score available, and the vulnerability is not listed in CISA’s KEV catalog. Attackers would need to provide malicious PKCS#7 data to the vulnerable decode path, which is typically an application‑level operation. Exploitation requires the ability to influence the data being decoded, so the attack vector is inferred to be application‑controlled input.