---
id: CVE-2026-15442
title: >-
  In all builds that make use of (D)TLS, including default builds, there is a
  series of conditional states during the TLS shutdown which could lead to a
  heap-use-after free
summary: >-
  In all builds that make use of (D)TLS, including default builds, there is a
  series of conditional states during the TLS shutdown which could lead to a
  heap-use-after free. If an application ended up getting a partial
  wolfSSL_read() which…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'
cwe:
  - CWE-416
vendor: wolfssl
product: wolfssl
affected:
  - 'wolfssl >= 4.4.0, <= 5.9.2'
published: '2026-09-27'
updated: '2026-10-02'
sourceUpdated: '2026-10-02T18:58:59.187'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-15442'
references:
  - url: 'https://github.com/wolfSSL/wolfssl/pull/10863'
    label: facts@wolfssl.com
tags:
  - nvd
  - cve.org
  - score-dispute
epss: 0.00207
epssPercentile: 0.10735
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-30T10:47:12.677039Z'
scores:
  nvd: 5.3
  cna: 2.3
ingestedAt: '2026-09-27T09:45:46.029Z'
---

## Overview

In all builds that make use of (D)TLS, including default builds, there is a series of conditional states during the TLS shutdown which could lead to a heap-use-after free. If an application ended up getting a partial wolfSSL_read() which is sometimes caused by a small user buffer  passed in, then called wolfSSL_shutdown for a bidirectional close and attempted to wolfSSL_read() again while the peer continues trying to send data during the shutdown it would lead to a state where a potential heap-use-after free happened.

## Affected

- `wolfssl >= 4.4.0, <= 5.9.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.