Date: October 6, 2026
Severity: Medium
Affected Users: Servers and applications using wolfSSH versions 1.4.11 through 1.5.0 on non-Windows platforms. Applications that call wolfSSH_RealPath() directly are additionally exposed (see below).
Fixed In: wolfSSH v1.6.0 (PR 1084)
Summary
wolfSSH_RealPath() could be driven to write one byte past the end of a stack buffer. A crafted SFTP path from an authenticated user could corrupt an adjacent value and crash the process.
Background
wolfSSH_RealPath() takes a default directory and a path from the peer, resolves . and .., joins the pieces, and writes the normalized absolute path into an output buffer. The SFTP server uses it on paths supplied by the client, so it is an important place to be careful about lengths.
To append each path component, the function calls wstrncat(), wolfSSH’s portable bounded string concatenation helper.
The Vulnerability
The function limited each path component it appended by the space remaining in the output buffer, rather than by the size of the buffer. Once the accumulated path grew past the halfway point of the buffer, the unsigned length computation in wstrncat() wrapped around to a very large number. The bound then no longer limited anything, and the copy was effectively unbounded.
With a crafted SFTP path, the result was a single terminating NUL byte written one byte beyond the end of a stack buffer. That corrupts whatever value sits next to the buffer, and in practice crashed the process.
Exploiting this requires an authenticated session, because the path arrives in an SFTP request. Windows builds are not affected.
Applications that call the public wolfSSH_RealPath() function themselves are further exposed. If such an application passes an output buffer smaller than its input, the copy is unbounded.
The Fix
wolfSSH v1.6.0 fixes both the caller and the helper:
- wolfSSH_RealPath() now checks that a path component fits in the output buffer, before it computes the space remaining.
- wstrncat() now computes its free space safely. If the destination is already full, it returns without copying.
The fix shipped in PR 1084, which also addressed other issues reported by the same researcher.
Recommendation
Update to wolfSSH v1.6.0 or later.
Applications that call wolfSSH_RealPath() directly should also make sure the output buffer is at least as large as the input path they pass in.
Credit
Thank you to Asif Nadaf for reporting this issue.
References
If you have questions about any of the above, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.
Download wolfSSL Now