CVE-2026-7531: wolfSSL

Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days.

Use-after-free in PQC hybrid key-share handling. This is an incomplete-fix follow-up to CVE-2026-5460 (released in 5.9.1): a malicious TLS 1.3 server sending a truncated PQC hybrid KeyShare can still trigger the error cleanup path to operate on freed memory.

Affected products

• wolfSSL wolfSSL: from 5.8.0, before 5.9.2 (fixed in 5.9.2)

Published 2026-06-25. Last modified 2026-06-26.