CVE-2026-5393 is an out-of-bounds read (CWE-125) in wolfSSL when it processes a dual-algorithm CertificateVerify message. It occurs only in builds made with the experimental and dual algorithm certificate options. NVD scores it 9.1 critical. Most builds are not affected; update to 5.9.1 if yours is.
What's affected
wolfSSL builds that were configured with both the experimental option and the dual algorithm certificates option. The wolfSSL changelog lists the fix in release 5.9.1 under pull request 10079 and files it under an Experimental Build Vulnerability heading with a Medium rating.
Standard builds, including most distribution packages, do not enable these options. The scores differ again: NVD gives 9.1, and wolfSSL rates it Medium because of the narrow build condition.
How to check if you're exposed
The question is how your wolfSSL was built. The two options are named below.
--enable-experimental --enable-dual-alg-certs
For a build from source, look at the first lines of config.log, which record the configure command:
head -20 config.log | grep configure
For a vendor package, ask the vendor or check the build recipe. If neither option was used, this CVE does not apply to your build.
You can also run the free in-browser dependency scan or browse the Gold directory to see where this component shows up in your stack.
What to do now
- Confirm whether any product of yours was built with the experimental dual algorithm option.
- If so, update to wolfSSL 5.9.1 or later and rebuild.
- If you do not need dual algorithm certificates, rebuild without the option.
- Keep experimental options out of production builds as a rule.
- Record build flags in your build metadata so such questions have quick answers.
Why it matters
Dual algorithm certificates carry two signatures, often a classical one and a post quantum one, so a connection stays safe if either algorithm is later broken. The feature is experimental in wolfSSL. The bug is in the parsing of the CertificateVerify message, where crafted input causes a read past the end of a buffer. That is CWE-125.
An out-of-bounds read can leak memory contents or crash the process. NVD's high scores for confidentiality and availability reflect that. The record does not report exploitation, and the CVE is not in the CISA KEV catalog.
The practical lesson is about experimental flags. Features meant for testing deserve a separate check in a build review.
Quick check
Is my distribution's wolfSSL package affected?
Only if it was built with the experimental dual algorithm options, which is unusual. Check the package's build notes.
Why did NVD score it 9.1?
The scoring does not take the build condition into account. Real exposure is narrower.
Sources
Last reviewed: 19 October 2026.
