CVE-2026-12340: WolfSSL SM2 Out-of-Bounds Heap Read – Certificate DoS

Technical summary

CVE-2026-12340 is an out-of-bounds heap read in WolfSSL affecting Subject Key Identifier (SKI) computation during SM2/SM3 certificate signature verification. When a certificate with an SM3wSM2 signature is parsed, the code unconditionally reads the trailing 65 bytes of the subject's public key without length validation. If the public key is shorter than 65 bytes, the read extends past the allocated heap buffer. The vulnerability is present only in builds configured with SM2 support (via --enable-sm2 or --enable-all flags). No heap write occurs, limiting the attack surface to denial of service and potential information disclosure of adjacent heap memory.

Business impact

Organizations using WolfSSL with SM2 enabled in certificate validation or TLS server roles face availability risk. An attacker can send a malformed certificate with a truncated SM2 public key, triggering an out-of-bounds read that crashes the application. This leads to service interruption and potential cascading failures in dependent systems. The impact is most severe in automated certificate processing pipelines, IoT deployments, and edge devices where WolfSSL is embedded without extensive input sanitization upstream.

Affected systems

WolfSSL versions prior to remediation are affected when built with SM2 support. This includes any deployment using --enable-sm2 or --enable-all compile options. The vulnerability does not affect builds compiled without SM2 support, making scope-limited in organizations using WolfSSL primarily for legacy cryptography or non-SM2 use cases. SM2 adoption is concentrated in deployments targeting Chinese regulatory requirements and PKI ecosystems.

Exploitability

Exploitation requires network access to send a certificate with a malformed SM2 public key to a vulnerable service. No authentication, user interaction, or special client-side conditions are required. The attack surface is present whenever WolfSSL processes untrusted certificates—including TLS handshakes, OCSP responders, or certificate chain validation in automated systems. The low barrier to exploitation is offset by the constraint that only SM2-enabled builds are vulnerable and SM2 adoption remains niche outside specific regional and regulatory contexts.

Remediation

Update WolfSSL to a patched version that includes bounds checking prior to reading the public key during SKI computation. The fix validates that the SM2 public key length meets the 65-byte minimum before accessing those bytes. Organizations should verify patch availability from WolfSSL's security advisories and test in non-production environments before deployment. For builds not using SM2, no action is required beyond standard patching practices.

Patch guidance

Consult the WolfSSL security advisory and release notes for the specific patched version addressing CVE-2026-12340. Apply patches to all WolfSSL instances in certificate validation paths, particularly those configured with SM2 support. Verify that compiled binaries include the SM2 fix and are built from patched source. Perform integration testing with existing certificate chains to confirm no regression in legitimate SM2 or other signature verification workflows. Organizations should document which deployments use SM2 to prioritize patching where the vulnerability is actually present.

Detection guidance

Monitor for application crashes or service restarts correlated with certificate processing, especially in environments processing certificates from external sources. Review logs for errors during certificate parsing or Subject Key Identifier computation. Check WolfSSL build configurations across your infrastructure to identify which systems have SM2 enabled via --enable-sm2 or --enable-all. Implement certificate validation in network IDS/IPS to flag certificates with truncated SM2 public keys (length <65 bytes). Heap memory corruption detection tools and sanitizers (AddressSanitizer, Valgrind) will flag the out-of-bounds read if deployed in development or testing.

Why prioritize this

This vulnerability warrants HIGH priority for organizations with SM2-enabled WolfSSL deployments in certificate validation or public-facing TLS roles. The low complexity of exploitation and direct path from malformed certificate to denial of service justify urgent patching in affected systems. However, organizations without SM2 support can safely defer this update. The lack of data breach or integrity risk (no write, no information leak) means prioritization should reflect service availability criticality rather than data sensitivity.

Risk score, explained

CVSS 3.1 score of 7.5 (HIGH) reflects network accessibility, low attack complexity, no privileges required, and high availability impact (denial of service). The absence of confidentiality and integrity impacts prevents a Critical rating. The constraint that only SM2-enabled builds are vulnerable is a deployment-time decision rather than a network-exploitable bypass, so the score does not apply a population adjustment. Real-world risk depends heavily on whether SM2 is actually enabled in your infrastructure and whether untrusted certificate input reaches vulnerable code paths.

Frequently asked questions