CVE-2026-6679

HighCVSS 7.5/10Last modified Jun 27, 2026

Description

A heap buffer overflow could occur in the DTLS 1.3 ACK serialization path before the connecting peer is authenticated. The buffer overflow was due to an integer truncation when computing the length of the ACK record-number list, causing an undersized buffer to be allocated and then overrun. This affects builds using DTLS 1.3 and wolfSSL version 5.9.0 and earlier. A fix was added to the 5.9.1 release.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-190 CWE-197 CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Jun 25, 2026
Last modified: Jun 27, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-667929.9A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a user on a managed cluster to escalate their CVE-2026-667938.8A flaw was found in the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes. A user with perm CVE-2026-667949.3A flaw was found in the `cluster-proxy-addon` component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated CVE-2026-667959.9A flaw was found in the managedcluster-import-controller. The Certificate Signing Request (CSR) auto-approval logic improperly validates inc CVE-2026-667975.4Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure. The addAnnotation CVE-2026-667984.3Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.CVE-2026-667997.8Heap-based buffer overflow in Windows Key Guard allows an authorized attacker to elevate privileges locally.CVE-2026-668007.5Server-side request forgery (ssrf) in Azure Data Factory allows an unauthorized attacker to disclose information over a network.CVE-2026-668028.1Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Health Attestation (DHA) allow CVE-2026-6680310.0Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network.CVE-2026-668047.8Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally.CVE-2026-668058.8Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.