CVE-2026-83742: wolfSSH 1.4.11 through 1.5.0; status changes: 1.6.0 — unaffected

Affected technology

wolfSSH · 1.4.11 through 1.5.0; status changes: 1.6.0 — unaffected
wolfSSL Inc.

Description’s affected range: through v1.5.0 on non-Windows platforms

Component: Not specified by the source
File: src/port.c, src/ssh.c

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

An authenticated remote attacker can write one out-of-bounds null byte past the end of a stack buffer by sending a crafted SFTP path. wolfSSH_RealPath() in src/ssh.c appends each path component with a remaining-size bound (outSz - curSz) rather than the full destination size, so once the accumulated path reaches half the output buffer the size_t computation n - strlen(s1) - 1 wraps to near SIZE_MAX. Vendor/CNA’s CVSS 4.0 assessment (base score 5.3/10) rates confidentiality impact as none; integrity and availability impact as low.