Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Heap-based buffer overflow in the KCAPI ECC code path of wc_ecc_import_x963_ex() in wolfSSL wolfcrypt allows a remote attacker to write attacker-controlled data past the bounds of the pubkey_raw buffer via a crafted oversized EC public key point. The WOLFSSL_KCAPI_ECC code path copies the input to key->pubkey_raw (132 bytes) using XMEMCPY without a bounds check, unlike the ATECC code path which includes a length validation. This can be triggered during TLS key exchange when a malicious peer sends a crafted ECPoint in ServerKeyExchange.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-19 | 1 | General1 |
| 2026-03-22 | 2 | Disclosure2 |
CVE-2026-4395 Heap-based buffer overflow in the KCAPI ECC code path of wc_ecc_import_x963_ex() in wolfSSL wolfcrypt allows a remote attacker to write attacker-controlled data past th… https://www.cve.org/CVERecord?id=CVE-2026-4395
Post summary
The post reports a heap-based buffer overflow in wolfSSL's ECC import routine that could enable remote memory writes, but no PoC, exploit, or patch details are included.
🚨*CVE* CVE-2026-4395 Heap-based buffer overflow in the KCAPI ECC code path of wc_ecc_import_x963_ex() in wolfSSL wolfcrypt allows a remote attacker to write attacker-controlled data past th… https://www.cve.org/CVERecord?id=CVE-2026-4395 ----- Traducción: CVE-2026-4395 des… http://infoflow.cloud`
Post summary
The post announces CVE‑2026‑4395, a heap‑based buffer overflow in wolfSSL wolfcrypt that could enable remote attackers to write arbitrary data, but it contains no PoC, exploit, active use, patch, or debunking information.
CVE-2026-4395 Heap Buffer Overflow in wolfSSL wolfcrypt ECC Key Import Function https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-4395
Post summary
The post merely announces CVE‑2026‑4395 with a brief technical description, offering no detailed exploit, patch, or active exploitation evidence.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | wolfssl | wolfssl | - | - | - |