Is CVE-2026-2646 actively exploited?

No active exploitation of CVE-2026-2646 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-2646 be exploited remotely?

No. CVE-2026-2646 requires local access to exploit.

What is the CVSS score of CVE-2026-2646?

CVE-2026-2646 has a CVSS score of 5.0 (MEDIUM).

HOME VULNERABILITIESCVE-2026-2646

MEDIUM

CVE-2026-2646

CWE-122Published: March 19, 2026· Updated: Mar 20, 2026

5.0

CVSS v3.1

EPSS:0.01%probability of exploitation in 30 daysPercentile:1.5th

Official Description

A heap-buffer-overflow vulnerability exists in wolfSSL's wolfSSL_d2i_SSL_SESSION() function. When deserializing session data with SESSION_CERTS enabled, certificate and session id lengths are read from an untrusted input without bounds validation, allowing an attacker to overflow fixed-size buffers and corrupt heap memory. A maliciously crafted session would need to be loaded from an external source to trigger this vulnerability. Internal sessions were not vulnerable.

NVD Source

Technical Analysis

CVE-2026-2646 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorLocal

Attack ComplexityHigh

Privileges Req.Low

User InteractionNone

ScopeX

Impact

Confidentiality

Integrity

Availability

CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X