CVE-2026-5504

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A padding oracle exists in wolfSSL's PKCS7 CBC decryption that could allow an attacker to recover plaintext through repeated decryption queries with modified ciphertext. In previous versions of wolfSSL the interior padding bytes are not validated.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-354

Affected software

VendorProductVersions
wolfSSLwolfSSL<= 5.9.0

References

Timeline

Published
Apr 9, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-550409.1Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-550417.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2026-550425.5Use of uninitialized resource in Microsoft Office allows an unauthorized attacker to disclose information locally.CVE-2026-550437.8Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.CVE-2026-550447.8Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2026-550458.4Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2026-550465.5Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.CVE-2026-550475.5Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.CVE-2026-550487.8Integer overflow or wraparound in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2026-550497.8Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2026-55056.4The WP-Clippy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `clippy` shortcode in all versions up to, aCVE-2026-550505.5Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
CVE-2026-5504: Medium severity, CVSS 5.3 | Vulnix