CVE-2026-83742: CWE-191 Integer Underflow (Wrap or Wraparound) in wolfSSL Inc. wolfSSH

An unsigned integer underflow in the wstrncat() function within src/port.c of wolfSSL wolfSSH (versions >=1.4.11 <1.6.0) on non-Windows platforms allows an authenticated remote attacker to write one out-of-bounds null byte past the end of a stack buffer. This happens because wolfSSH_RealPath() appends path components using a remaining-size bound (outSz - curSz) rather than the full buffer size. When the accumulated path length reaches about half the output buffer, the size_t calculation (n - strlen(s1) - 1) underflows to a very large value, causing strncat() to copy the entire component unchecked. If the component exactly fills the remainder of the buffer, the terminating null byte is written one byte beyond the buffer boundary. This can corrupt adjacent stack memory and cause a crash. Additionally, if wolfSSH_RealPath() is called with an output buffer smaller than the input path, an unbounded copy can occur due to a similar wraparound in length checks. The vulnerability requires authentication and no known exploits are reported.

The vulnerability allows an authenticated remote attacker to cause a stack buffer overflow by writing a single null byte beyond the buffer boundary. This can corrupt adjacent stack memory and potentially crash the affected process. There is no indication of code execution or privilege escalation from the available data. The impact is limited to denial of service via process crash or memory corruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, avoid using vulnerable versions (>=1.4.11 <1.6.0) on non-Windows platforms or restrict authenticated user input to prevent crafted SFTP paths that could trigger the overflow. Monitor vendor communications for official fixes.