Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
An integer overflow existed in the wolfCrypt CMAC implementation, that could be exploited to forge CMAC tags. The function wc_CmacUpdate used the guard `if (cmac->totalSz != 0)` to skip XOR-chaining on the first block (where digest is all-zeros and the XOR is a no-op). However, totalSz is word32 and wraps to zero after 2^28 block flushes (4 GiB), causing the guard to erroneously discard the live CBC-MAC chain state. Any two messages sharing a common suffix beyond the 4 GiB mark then produce identical CMAC tags, enabling a zero-work prefix-substitution forgery. The fix removes the guard, making the XOR unconditional; the no-op property on the first block is preserved because digest is zero-initialized by wc_InitCmac_ex.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-10 | 1 | Disclosure1 |
| 2026-04-11 | 1 | General1 |
| 2026-04-14 | 1 | Disclosure1 |
CVE-2026-5477 An integer overflow existed in the wolfCrypt CMAC implementation, that could be exploited to forge CMAC tags. The function wc_CmacUpdate used the guard `if (cmac->total… https://www.cve.org/CVERecord?id=CVE-2026-5477
Post summary
CVE-2026-5477 describes an integer overflow in wolfCrypt CMAC that permits forging of CMAC tags, with no evidence of active exploitation, PoC, or patch information.
CVE-2026-5477 Integer Overflow in wolfCrypt CMAC Implementation Enabling Tag Forgery https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-5477
Post summary
The text reports CVE-2026-5477 as an integer overflow in wolfCrypt’s CMAC that permits tag forgery, with only a reference link and no exploit, patch, or PoC details.
⚡ New CVE Alert: CVE-2026-5477 📊 Severity: 8.2 🚨 Risk Level: High 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-5477 #CVE-2026-5477 #CVE #High #CyberSecurity #InfoSec https://t.co/SPPmQ0E4HZ
Post summary
The tweet announces CVE-2026-5477 with a severity rating, but provides no technical details, exploitation status, or remediation information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | wolfssl | wolfssl | - | - | - |