CVE-2026-5393 OOB Read in DoTls13CertificateVerify with WOLFSSL_DUAL_ALG_CERTS

Medium 6.3 Published 9 Apr 2026 Updated 10 Apr 2026

An out-of-bounds read in wolfSSL's dual-algorithm CertificateVerify processing can cause crashes or leak memory when experimental features are enabled.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-5393?

CVE-2026-5393 is a medium-severity memory corruption vulnerability in Wolfssl Wolfssl, published on 9 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Dual-Algorithm CertificateVerify out-of-bounds read. When processing a dual-algorithm CertificateVerify message, an out-of-bounds read can occur on crafted input. This can only occur when --enable-experimental and --enable-dual-alg-certs is used when building wolfSSL.

Weakness: CWE-125

Which versions are affected by CVE-2026-5393?

It affects 1 product.

Products include Wolfssl Wolfssl.

How do I fix CVE-2026-5393?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-5393 being exploited?

There is no known exploitation of CVE-2026-5393 in the wild and no public exploit code.

All Wolfssl Wolfssl vulnerabilities

Sources

Also known as DEBIAN-CVE-2026-5393, GHSA-f4w6-5m9p-28hw, JLSEC-2026-721, UBUNTU-CVE-2026-5393.