CVE-2019-18840

PoC —

CVSS 3.1

7.5 high

EPSS

2%p79

Published

Nov 9, 2019 (Nov 9, 2019)

Modified

Jun 17, 2026

Description

In wolfSSL 4.1.0 through 4.2.0c, there are missing sanity checks of memory accesses in parsing ASN.1 certificate data while handshaking. Specifically, there is a one-byte heap-based buffer overflow inside the DecodedCert structure in GetName in wolfcrypt/src/asn.c because the domain name location index is mishandled. Because a pointer is overwritten, there is an invalid free.

Vendors: wolfssl
Products: wolfssl
Weakness: CWE-787
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

NVD CVE.org GitHub PoCs EPSS (2.0%)

In the news0 stories

No ingested article mentions this CVE yet.