Loading story…
Two high-severity memory-corruption vulnerabilities were disclosed in widely used TLS-related software components. CVE-2026-5264 affects wolfSSL and stems from DTLS 1.3 ACK message processing, where a remote attacker can send a crafted ACK packet to trigger a heap buffer overflow. The flaw is classified as CWE-122 and is network-reachable with low attack complexity and no privileges or user interaction required, raising concern for applications that expose DTLS 1.3 services.
A separate flaw, CVE-2026-5402, was disclosed in Wireshark’s TLS protocol dissector and affects versions 4.6.0 through 4.6.4. The vulnerability is also a heap-based buffer overflow (CWE-122) and could allow denial of service and possible code execution when malicious traffic is processed, with the CVSS vector indicating high impact to confidentiality, integrity, and availability. Public references point to a wolfSSL GitHub pull request for the DTLS issue and to a GitLab issue and official Wireshark security advisory for the dissector flaw.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
A new CVE entry, CVE-2026-5402, was received by cve@gitlab.com for a heap-based buffer overflow in Wireshark's TLS protocol dissector affecting versions 4.6.0 through 4.6.4. The issue can cause denial of service and potentially code execution, and references were added to a GitLab issue and an official Wireshark security advisory.
A new vulnerability, CVE-2026-5264, was received by facts@wolfssl.com involving a heap buffer overflow in DTLS 1.3 ACK message processing. The flaw allows a remote attacker to send a crafted DTLS 1.3 ACK message to trigger the overflow, and a wolfSSL GitHub pull request was referenced in the record.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity vulnerabilities were disclosed in **Mbed TLS**, including a buffer overflow in FFDH public key export tracked as `CVE-2026-34875` and a memory-corruption issue tied to serialized SSL context or session structures tracked as `CVE-2026-34877`. The first flaw affects **Mbed TLS through 3.6.5** and **TF-PSA-Crypto 1.0.0**, while the second impacts **Mbed TLS 2.19.0 through 3.6.5** as well as **4.0.0**. Both issues were assigned a `CVSS v3.1` score vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, indicating remotely exploitable conditions with low attack complexity and high impact on confidentiality, integrity, and availability. `CVE-2026-34875` is classified under **CWE-120** and occurs during export of FFDH public keys, creating a buffer overflow condition. `CVE-2026-34877` is associated with **CWE-502** and **CWE-250** and can lead to arbitrary code execution if an attacker can alter serialized SSL context or session data before it is processed. Mbed TLS security advisories were published for both flaws, putting organizations that embed the library in network-facing products, cryptographic services, or TLS-enabled applications on notice to review affected versions and vendor guidance immediately.
Jun 29, 2026
A public disclosure reported that **wolfSSL** versions `5.7.2` through `5.9.0-stable` contain a flaw in the **ML-DSA-44** signing path that frees a heap buffer holding private signing material without clearing it first. In native ML-DSA builds enabled with `--enable-mldsa` or `--enable-dilithium`, a same-process attacker can recover secret key material from reused heap memory and forge signatures on arbitrary messages. Researcher Abhinav Agarwal demonstrated end-to-end signature forgery on Linux and macOS, with forged signatures accepted by `wc_dilithium_verify_msg()` in compiled `libwolfssl` binaries. wolfSSL confirmed the issue and addressed it through fixes referenced in pull requests **#10100** and **#10113**, with the remediation shipping in **wolfSSL 5.9.1-stable**. The vendor did not assign a CVE and reportedly classified the finding as a bug rather than a vulnerability, even as its broader release advisory warned of multiple cryptographic verification weaknesses affecting certificate validation and signature handling. The disclosure also noted that similar missing-memory-clearing problems had previously been corrected in wolfSSL code paths for Dilithium key generation, Ed25519 signing, and Ed448 signing.
Jun 29, 2026
Two high-severity vulnerabilities were disclosed in **rust-openssl**, the Rust bindings for OpenSSL, affecting multiple `0.9.x` and `0.10.x` releases prior to **`0.10.78`**. **`CVE-2026-41898`** affects versions from `0.9.24` up to, but not including, `0.10.78`, where several FFI trampoline callback paths passed a closure-returned `usize` to OpenSSL without validating it against the output buffer size. The flaw can trigger buffer overflows and leak adjacent memory to a network peer, and it is mapped to **`CWE-126`** and **`CWE-130`**. A second issue, **`CVE-2026-41681`**, affects versions from `0.10.39` up to, but not including, `0.10.78`, in `MdCtxRef::digest_final()`, which writes `EVP_MD_CTX_size(ctx)` bytes to the caller buffer without checking whether the buffer is large enough. The resulting out-of-bounds write can cause stack corruption and is reachable from safe Rust, with the weakness classified as **`CWE-121`**. Both vulnerabilities were addressed in **`rust-openssl 0.10.78`**, with public advisories, code references, and fix details released alongside the CVE records.
Jun 29, 2026