CVE-2026-55958

Name of the Vulnerable Software and Affected Versions wolfSSL (affected versions not specified)

Description An out-of-bounds write exists in the Renesas TSIP TLS 1.3 transcript buffer. In the tsip StoreMessage() function, a capacity check for the fixed message bag (MSGBAG SIZE) sets an error code but fails to return. This allows execution to proceed to an XMEMCPY operation that writes past the end of the 8 KB buffer when the accumulated TLS 1.3 handshake transcript exceeds the limit. This issue specifically affects builds using the Renesas TSIP TLS port (WOLFSSL RENESAS TSIP TLS) as a TLS 1.3 client on Renesas MCUs with TSIP hardware enabled. A remote attacker can trigger this by sending an oversized handshake message or using an unusually large certificate chain, leading to heap corruption and a potential denial of service crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.