CVE-2026-5460
CWE-416Published: April 10, 2026· Updated: Apr 13, 2026
Official Description
A heap use-after-free exists in wolfSSL's TLS 1.3 post-quantum cryptography (PQC) hybrid KeyShare processing. In the error handling path of TLSX_KeyShare_ProcessPqcHybridClient() in src/tls.c, the inner function TLSX_KeyShare_ProcessPqcClient_ex() frees a KyberKey object upon encountering an error. The caller then invokes TLSX_KeyShare_FreeAll(), which attempts to call ForceZero() on the already-freed KyberKey, resulting in writes of zero bytes over freed heap memory.
Technical Analysis
CVE-2026-5460 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.
The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.
A proof-of-concept (PoC) exploit exists for CVE-2026-5460. While not yet confirmed in active campaigns, the availability of PoC code increases exploitation risk substantially.
From a weakness classification perspective (CWE-416): Use-after-free vulnerabilities involve accessing memory after it has been freed, often enabling arbitrary code execution.
CVSS v3.1 Vector Breakdown
Exploit & PoC Resources
All References (1)
Quick Facts
Related CVEs (CWE-416)
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2026-5460 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts