From fac08427e5cf3179a25dd3b0a806fdf9b3e46b42 Mon Sep 17 00:00:00 2001
From: Juliusz Sosinowicz <juliusz@wolfssl.com>
Date: Mon, 16 Mar 2026 15:44:09 +0100
Subject: [PATCH] Fix missing op validation in EVP_PKEY_decrypt

F-747
---
 wolfcrypt/src/evp.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/wolfcrypt/src/evp.c b/wolfcrypt/src/evp.c
index 9aaefbef2b..e1a45c2d22 100644
--- a/wolfcrypt/src/evp.c
+++ b/wolfcrypt/src/evp.c
@@ -3096,6 +3096,12 @@ int wolfSSL_EVP_PKEY_decrypt(WOLFSSL_EVP_PKEY_CTX *ctx,
         return 0;
     }
 
+    if (ctx->op != WC_EVP_PKEY_OP_DECRYPT) {
+        WOLFSSL_MSG("ctx->op must be set to WC_EVP_PKEY_OP_DECRYPT. Use "
+            "wolfSSL_EVP_PKEY_decrypt_init.");
+        return WOLFSSL_FAILURE;
+    }
+
     (void)out;
     (void)outLen;
     (void)in;