The vulnerability (CVE-2026-55958) is an out-of-bounds write in the Renesas TSIP TLS 1.3 transcript buffer. In the tsip_StoreMessage() function, a capacity check for the fixed-size message bag (8 KB) sets an error code but does not return, causing execution to continue to an XMEMCPY operation that writes beyond the buffer boundary. This occurs when the TLS 1.3 handshake transcript exceeds the buffer size, which can happen with an unusually large but valid certificate chain or a maliciously oversized handshake message from a server. This leads to heap corruption and may cause a remote denial of service crash. The vulnerability only affects TLS 1.3 client builds using the Renesas TSIP TLS port on Renesas MCUs with TSIP hardware enabled. All other builds and configurations are unaffected.

The vulnerability can cause heap corruption due to an out-of-bounds write, potentially leading to a remote denial of service crash. It requires a TLS 1.3 handshake transcript larger than 8 KB, which is uncommon and typically only occurs with unusually large certificate chains or malicious oversized handshake messages. This impacts only specific Renesas TSIP TLS client builds on Renesas MCUs with TSIP hardware enabled. There is no indication of code execution or data disclosure from the provided data.

No patch or official fix information is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, avoid using the affected Renesas TSIP TLS client builds with TSIP hardware enabled in environments where untrusted or malicious servers might send oversized TLS 1.3 handshake messages. Monitor vendor communications for updates and apply patches once available.