CVE-2026-83742 is a stack buffer overflow in wolfSSH 1.4.11 through 1.5.0 on non-Windows platforms, rated high (CVSS 8.8) in the record. An authenticated user can send a crafted SFTP path that writes one null byte past a buffer. wolfSSL rates it medium and lists the fix in 1.6.0.
What's affected
The record covers wolfSSH from 1.4.11 through 1.5.0 on non-Windows platforms. The flaw is in wolfSSH_RealPath() in src/ssh.c and the wstrncat() helper in src/port.c. The caller needs an authenticated session.
Severity conflict: the record gives CVSS 8.8, which is High. The wolfSSL vulnerabilities page I fetched lists this CVE as Medium. It describes the practical effect as a single terminating null byte written one byte past the end of a stack buffer, which can corrupt an adjacent value and crash the process. Both are correct as statements of source, so I report both. Use the one your policy requires, and treat a crash of the SSH server as the realistic floor.
The page lists the fix in release 1.6.0, via pull request 1084, and credits a named researcher. The record names no fixed version. A second use case is also described: applications that call the public wolfSSH_RealPath() with an output buffer smaller than the input path are exposed to an unbounded copy.
How to check if you're exposed
Check the wolfSSH version your product links against. The version string is visible in your build system, your package manager, or the library header of the copy you ship:
dpkg -l | grep -i wolfssh
On embedded targets, check the source tree or firmware bill of materials, because many devices bundle wolfSSH statically and nothing on the device reports it. If you find a version from 1.4.11 to 1.5.0 built for a non-Windows platform with SFTP enabled, you are in scope.
If you call wolfSSH_RealPath() directly from your own code, review the buffer size you pass. The advisory says a buffer smaller than the input path adds a separate exposure.
What to do now
- Upgrade wolfSSH to 1.6.0, the release the wolfSSL page lists as the fix.
- If you ship firmware or an appliance, produce a new build and tell your customers which version contains the fix.
- If SFTP is not needed, disable it on devices where it is not used.
- Review any direct calls to wolfSSH_RealPath() and make sure the output buffer is at least as large as the longest path you accept.
- Monitor SSH service restarts, since a crash is the likely visible symptom.
Why it matters
The record lists a stack based buffer overflow, CWE-121, an integer underflow, CWE-191, and an off-by-one error, CWE-193. The chain is simple. A length calculation subtracts one unsigned number from another, the result wraps to a huge value, and a copy that was meant to be bounded is not. The caller's own length check keeps the data inside the buffer, so only one terminating byte escapes.
One byte is small, but stack corruption is worth taking seriously, since an adjacent value may be a saved pointer or a flag. For defenders the lesson is the same as with every unsigned arithmetic bug: check the wrap before the copy. The record does not list this CVE as exploited in the wild.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why do the sources disagree on severity?
The record scores it 8.8 High, while the wolfSSL page lists Medium. They weigh the single byte overflow differently. Treat it as a crash risk at minimum.
Is Windows affected?
The record scopes this one to non-Windows platforms. The Windows server has a separate issue, CVE-2026-83540.
Sources
Last reviewed: 18 October 2026.
