CVE-2025-11931 Integer Underflow Leads to Out-of-Bounds Access in XChaCha20-Poly1305 Decrypt
An integer underflow in wolfSSL's XChaCha20-Poly1305 decryption allows out-of-bounds access, potentially leading to code execution or crashes when the function is called directly.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-11931?
CVE-2025-11931 is a low-severity vulnerability in Wolfssl Wolfssl, published on 21 Nov 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Integer Underflow Leads to Out-of-Bounds Access in XChaCha20-Poly1305 Decrypt. This issue is hit specifically with a call to the function wc_XChaCha20Poly1305_Decrypt() which is not used with TLS connections, only from direct calls from an application.
Weakness: CWE-191
Which versions are affected by CVE-2025-11931?
It affects 1 product.
Products include Wolfssl Wolfssl.
How do I fix CVE-2025-11931?
Apply the vendor's patch.
Is CVE-2025-11931 being exploited?
There is no known exploitation of CVE-2025-11931 in the wild and no public exploit code.
Other vulnerabilities in Wolfssl Wolfssl
Sources
Also known as DEBIAN-CVE-2025-11931, GHSA-h957-386q-gm5j, JLSEC-2026-686, UBUNTU-CVE-2025-11931.