CVE-2026-5264 is a heap buffer overflow (CWE-122) in the DTLS 1.3 ACK message handling of wolfSSL, scored 9.8 critical. A remote attacker can send a crafted ACK to trigger it. The fix is in wolfSSL 5.9.1, so update and rebuild products that use DTLS 1.3.
What's affected
wolfSSL releases before 5.9.1 where DTLS 1.3 is built in and used. The project changelog lists the fix in release 5.9.1 under pull request 10076 and rates it High.
If you use only TLS over TCP, or DTLS 1.2, the described code path is not part of your traffic. DTLS 1.3 shows up most in IoT and real time systems that run over UDP.
How to check if you're exposed
Find the wolfSSL version your product links against. For a system package:
dpkg -l | grep -i wolfssl
rpm -q wolfssl
For a build from source, read the version macro in wolfssl/version.h. Embedded firmware often bundles wolfSSL as source, so ask the vendor or search the source tree:
grep -rn "LIBWOLFSSL_VERSION_STRING" .
Anything before 5.9.1 is affected, because the changelog lists the fix in that release. Then see whether DTLS 1.3 is in use. Search your application for DTLS 1.3 method calls, for example wolfDTLSv1_3_client_method or wolfDTLSv1_3_server_method, and check your build for the --enable-dtls13 option in config.log.
You can also run the free in-browser dependency scan or browse the Gold directory to see where this component shows up in your stack.
What to do now
- Find devices and services that terminate DTLS, such as IoT gateways, CoAP servers and media systems.
- Update to wolfSSL 5.9.1 or later and rebuild.
- Where you cannot update yet and do not need DTLS 1.3, fall back to a build without it.
- Limit which networks can send UDP traffic to DTLS endpoints.
- Ask device vendors for fixed firmware.
Why it matters
The ACK message in DTLS 1.3 tells the sender which records arrived. The processing code wrote past the end of a heap buffer when given crafted input, which is CWE-122. The record says no authentication is needed to send such a message, so the attack surface is any reachable DTLS 1.3 endpoint.
The record does not report exploitation, and the CVE is not in the CISA KEV catalog. UDP services are often forgotten in firewall reviews, which is one reason to check them directly.
Quick check
Am I affected if I only use TLS over TCP?
The advisory text concerns DTLS 1.3 ACK processing, so plain TLS traffic does not use it.
How do I tell if I use DTLS 1.3?
Search your code for DTLS 1.3 method calls and check your build configuration.
Sources
Last reviewed: 19 October 2026.
