Description
Unsigned integer underflow in wstrncat() in src/port.c in wolfSSL wolfSSH from v1.4.11 through v1.5.0 on non-Windows platforms allows an authenticated remote attacker to write one out-of-bounds null byte past the end of a stack buffer by sending a crafted SFTP path. wolfSSH_RealPath() in src/ssh.c appends each path component with a remaining-size bound (outSz - curSz) rather than the full destination size, so once the accumulated path reaches half the output buffer the size_t computation n - strlen(s1) - 1 wraps to near SIZE_MAX. The strncat() call is then effectively unbounded and copies the whole component; when that component exactly fills the remainder of the buffer, its terminating null is written one byte past the end. The caller's own length check keeps the copied data inside the buffer, so the overflow is limited to that single null byte, which may corrupt an adjacent stack value and crash the process. Applications that call the public wolfSSH_RealPath() with an output buffer smaller than the input path are additionally exposed to an unbounded copy, because the word32 expression outSz - segSz in that length check also wraps.
Published: 2026-10-07
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Stack Buffer Null Overwrite leading to Crash
Action: Apply Patch
AI Analysis

Impact

The vulnerability is an unsigned integer underflow in wstrncat() in wolfSSH, allowing a remote attacker that can authenticate via SFTP to send a specially crafted path. The flaw makes the length calculation wrap, resulting in a single null byte being written one byte past the end of a stack buffer. This off‑by‑one write can corrupt an adjacent stack value and crash the process, potentially enabling further exploitation in the same session. The impact is limited to denial of service for the affected SSH service, but the corrupted stack may expose the attacker to additional risks if the application does not guard against further attacks.

Affected Systems

wolfSSL Inc. product wolfSSH, versions from 1.4.11 through 1.5.0 on non‑Windows platforms. Applications that call the public wolfSSH_RealPath() function with an output buffer smaller than the input path are also susceptible because the internal length check can wrap as well.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity. No EPSS score is publicly available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote authenticated attacker sending a crafted SFTP path over the network. Because the bug corrupts only a single null byte, exploitation is non‑trivial but can still cause the process to crash, denying service to legitimate users.

Generated by OpenCVE AI on October 7, 2026 at 04:18 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update to the fixed wolfSSH release (v1.5.1 or later, which corrects the length calculation in wstrncat and wolfSSH_RealPath).
  • If an immediate upgrade is not possible, disable or remove the SFTP service from the server to eliminate the trigger for the overflow.
  • When the SFTP service must remain, ensure that any application calling wolfSSH_RealPath supplies an output buffer that is at least as large as the input path and implement additional bounds checks to guard against the off‑by‑one error.

Generated by OpenCVE AI on October 7, 2026 at 04:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Wolfssh
Wolfssh wolfssh
CPEs cpe:2.3:a:wolfssh:wolfssh:*:*:*:*:*:*:*:*
Vendors & Products Wolfssh
Wolfssh wolfssh
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Wed, 07 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 07 Oct 2026 05:00:00 +0000

Type Values Removed Values Added
First Time appeared Wolfssl
Wolfssl wolfssh
Vendors & Products Wolfssl
Wolfssl wolfssh

Wed, 07 Oct 2026 03:00:00 +0000

Type Values Removed Values Added
Description Unsigned integer underflow in wstrncat() in src/port.c in wolfSSL wolfSSH from v1.4.11 through v1.5.0 on non-Windows platforms allows an authenticated remote attacker to write one out-of-bounds null byte past the end of a stack buffer by sending a crafted SFTP path. wolfSSH_RealPath() in src/ssh.c appends each path component with a remaining-size bound (outSz - curSz) rather than the full destination size, so once the accumulated path reaches half the output buffer the size_t computation n - strlen(s1) - 1 wraps to near SIZE_MAX. The strncat() call is then effectively unbounded and copies the whole component; when that component exactly fills the remainder of the buffer, its terminating null is written one byte past the end. The caller's own length check keeps the copied data inside the buffer, so the overflow is limited to that single null byte, which may corrupt an adjacent stack value and crash the process. Applications that call the public wolfSSH_RealPath() with an output buffer smaller than the input path are additionally exposed to an unbounded copy, because the word32 expression outSz - segSz in that length check also wraps.
Title wstrncat() unsigned integer underflow leads to an off-by-one null write in wolfSSH on non-Windows platforms
Weaknesses CWE-121
CWE-191
CWE-193
References
Metrics cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/AU:N'}

Subscriptions

Wolfssh Wolfssh
Wolfssl Wolfssh
cve-icon MITRE

Status: PUBLISHED

Assigner: wolfSSL

Published:

Updated: 2026-10-07T11:30:28.937Z

Reserved: 2026-08-31T22:49:43.798Z

Link: CVE-2026-83742

cve-icon Vulnrichment

Updated: 2026-10-07T11:30:25.337Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-07T03:16:59.880

Modified: 2026-10-13T14:29:47.630

Link: CVE-2026-83742

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-07T04:45:11Z

Weaknesses
  • CWE-121

    Stack-based Buffer Overflow

  • CWE-191

    Integer Underflow (Wrap or Wraparound)

  • CWE-193

    Off-by-one Error