Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Out-of-bounds write in the Renesas TSIP TLS 1.3 transcript buffer. In tsip_StoreMessage() the capacity check guarding the fixed message bag (MSGBAG_SIZE) sets an error code but fails to return, so execution falls through to an XMEMCPY that writes past the end of the buffer once the accumulated TLS 1.3 handshake transcript exceeds MSGBAG_SIZE (8 KB), corrupting adjacent heap state and potentially causing a remote denial of service crash. The bag is sized to hold a normal handshake, so this is reached only by an unusually large but valid certificate chain, or by a malicious or man-in-the-middle server sending an oversized handshake message to a client that does not strictly verify the chain. This only affects builds using the Renesas TSIP TLS port (WOLFSSL_RENESAS_TSIP_TLS) as a TLS 1.3 client on Renesas MCUs with TSIP hardware enabled, and is rated High within those builds. All other configurations are unaffected.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🚨 HIGH: CVE-2026-55958 (CVSS 7.5) - Out-of-bounds write in Renesas TSIP TLS 1.3 on wolfSSL. Remote DoS via oversized handshake messages. Affects Renesas MCU builds only (WOLFSSL_RENESAS_TSIP_TLS). Patch immediately. #CVE #PatchNow https://t.co/XtTnensYUM
Post summary
The tweet announces CVE-2026-55958, an out-of-bounds write causing remote DoS via oversized TLS 1.3 handshakes, and urges immediate patching for Renesas MCU builds.
🚨 HIGH - Renesas TSIP TLS 1.3 transcript OOB write in wolfSSL (CVE-2026-55958) An out-of-bounds write vulnerability exists in wolfSSL’s Renesas TSIP TLS 1.3 port, specifically the TLS 1.3 transcript buffer handling in tsip_StoreMessage() when built with WOLFSSL_RENESAS_TSIP_TLS. The root cause is a missing return after a capacity check, allowing XMEMCPY to proceed and write past a fixed 8KB transcript buffer (bounds check bypass leading to heap corruption). An attacker can trigger this remotely during a TLS 1.3 handshake by forcing an oversized-yet-valid transcript via unusually large certificate chains or malicious/mitM oversized handshake messages against a vulnerable TSIP-enabled Renesas MCU client. Successful exploitation can corrupt heap memory and reliably crash the client, resulting in remote denial of service. 👉 Affected: wolfSSL builds with WOLFSSL_RENESAS_TSIP_TLS enabled, TLS 1.3 client on Renesas MCUs with TSIP hardware | Upgrade to a vendor-fixed wolfSSL release once available (no fix version provided yet - treat as suspicious)
Post summary
CVE-2026-55958 is an out‑of‑bounds write in wolfSSL’s Renesas TSIP TLS 1.3 port that can cause heap corruption and denial‑of‑service; no PoC or active exploitation is reported, but a vendor fix is recommended.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | wolfssl | wolfssl | - | - | - |