Executive brief
wolfSSL is a cryptographic library used to secure communications for embedded devices and cloud services. A flaw was discovered in its implementation of ML-KEM (a post-quantum encryption standard) where the system only checked half of the security data during decryption on ARM64 processors. This could allow a sophisticated attacker to bypass certain security checks, potentially compromising the confidentiality of encrypted data.
Technical details
A vulnerability exists in the wolfSSL ML-KEM implementation specifically for ARM64 NEON optimized code paths. The constant-time ciphertext comparison logic (mlkem_cmp_neon) in the Fujisaki-Okamoto (FO) transform only compared the lower 64 bits of the input, effectively ignoring the upper half of the re-encrypted ciphertext. This failure to perform a full comparison breaks the implicit rejection mechanism required by the ML-KEM standard, weakening IND-CCA2 security. An attacker could potentially manipulate ciphertexts without detection by the decapsulating party. The issue was resolved by adjusting the NEON reduction step to fold the upper 64 bits into the lower before the scalar check.
Affected products
- wolfSSL wolfSSL 5.7.4 to 5.9.0
Timeline
- 2026-04-15: patched: Fix merged into master branch via PR 10192
- 2026-06-25: disclosed: CVE published and advisory released