Cyber Resilience

CVE-2026-6325

Low

Published: 25 June 2026

Published
25 June 2026
Modified
27 June 2026
KEV Added
Patch
CVSS Score v4 2.0 CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear
EPSS Score 0.0018 7.2th percentile
Risk Priority 15 floored blend · peak EPSS

Summary

CVE-2026-6325 is a low-severity Out-of-bounds Write (CWE-787) vulnerability in Wolfssl Wolfssl. Its CVSS base score is 2.0 (Low).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 7.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Out-of-bounds write in SetSuitesHashSigAlgo when processing an oversized signature algorithms list, allowing a write past the bounds of the destination buffer.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

Out-of-bounds write enables remote exploitation of public-facing services (T1190) and local privilege escalation via memory corruption (T1068).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2020-36177Same product: Wolfssl Wolfssl
CVE-2022-39173Same product: Wolfssl Wolfssl
CVE-2021-45939Same vendor: Wolfssl
CVE-2021-45936Same vendor: Wolfssl
CVE-2021-45934Same vendor: Wolfssl
CVE-2021-45938Same vendor: Wolfssl
CVE-2021-45937Same vendor: Wolfssl
CVE-2021-45933Same vendor: Wolfssl
CVE-2021-45932Same vendor: Wolfssl
CVE-2021-37563Shared CWE-787

Affected Assets

wolfssl
wolfssl
4.8.0 — 5.9.2

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-787

Out-of-bounds writes that corrupt control flow or inject shellcode are rendered non-executable by the same memory protections.

References