Executive brief
A security flaw was identified in wolfSSL's implementation of ML-KEM-1024, a post-quantum cryptographic algorithm used to secure data against future quantum computer threats. Due to a programming error in the high-performance assembly code for x64 processors, the system fails to properly verify the integrity of the final portion of encrypted messages. This could allow a sophisticated attacker to bypass certain security protections, potentially compromising the confidentiality of the encrypted communication.
Technical details
A vulnerability exists in the x64 AVX2 optimized implementation of ML-KEM-1024 within wolfSSL. The root cause is a failure in the Fujisaki-Okamoto (FO) transform's implicit rejection mechanism; specifically, the constant-time ciphertext comparison logic skips the final 32-byte block of the 1568-byte ciphertext. An attacker can manipulate these final 32 bytes without triggering the required implicit rejection, causing the decapsulation process to return the actual shared secret instead of a pseudo-random value. This breaks the IND-CCA2 security properties of the KEM. The issue is fixed in wolfSSL version 5.9.1.
Affected products
- wolfSSL wolfSSL 5.7.0 to 5.9.0
Timeline
- 2026-05-08: other: Fix submitted via GitHub pull request
- 2026-05-12: patched: Fix merged into master branch
- 2026-06-25: disclosed: CVE published to NVD