CVE-2026-5477 Details
Description
An integer overflow existed in the wolfCrypt CMAC implementation, that could be exploited to forge CMAC tags. The function wc_CmacUpdate used the guard `if (cmac->totalSz != 0)` to skip XOR-chaining on the first block (where digest is all-zeros and the XOR is a no-op). However, totalSz is word32 and wraps to zero after 2^28 block flushes (4 GiB), causing the guard to erroneously discard the live CBC-MAC chain state. Any two messages sharing a common suffix beyond the 4 GiB mark then produce identical CMAC tags, enabling a zero-work prefix-substitution forgery. The fix removes the guard, making the XOR unconditional; the no-op property on the first block is preserved because digest is zero-initialized by wc_InitCmac_ex.
An integer overflow vulnerability has been identified in the wolfCrypt CMAC implementation, which could be exploited to forge CMAC tags. The issue arises in the wc_CmacUpdate function, where a guard checks if the total size is not zero to skip XOR-chaining on the first block. However, this total size, being a 32-bit word, wraps to zero after approximately 4 GiB, leading the guard to incorrectly discard the active CBC-MAC chain state. Consequently, two messages sharing a common suffix beyond the 4 GiB limit can produce identical CMAC tags, facilitating a zero-work prefix-substitution forgery. The vulnerability has been addressed by removing the guard, allowing the XOR operation to be unconditional while preserving the no-op characteristic of the first block by initializing the digest to zero.
Users should update to the latest version of wolfSSL, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/wolfSSL/wolfssl/pull/10102 | [email protected] | Issue Tracking |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-190 | Integer Overflow or Wraparound | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| wolfssl wolfssl | <= 5.9.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 27, 2026 | Initial Analysis | [email protected] |
| Apr 10, 2026 | New CVE Received | [email protected] |