CVE-2026-6678: wolfSSL

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

Integer underflow in wc_PKCS7_DecryptOri when handling crafted Other Recipient Info, leading to incorrect length handling during decryption.

Affected products

• wolfSSL wolfSSL: from 3.15.5, before 5.9.2 (fixed in 5.9.2)

Published 2026-06-25. Last modified 2026-07-01.