# libcrux incorrect calculation on aarch64

Source: https://junglewise.ai/threats/libcrux-incorrect-calculation-on-aarch64-7318726c  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-04. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: high · CVSS 8.8 · Published 2025-12-04

libcrux is a cryptographic library used for quantum-resistant encryption and digital signatures. On certain ARM64 processors, version 0.0.3 contained a calculation error that produced incorrect cryptographic outputs—corrupting encrypted shared secrets and invalidating digital signatures. Applications relying on this library would fail security checks or expose encrypted data to compromise.

Technologies: [libcrux-ml-dsa (crates.io)](https://junglewise.ai/threats/technologies/libcrux-ml-dsa). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** High severity, with a CVSS score of 8.8, published 4 December 2025.

**Which products and versions are affected?** libcrux-intrinsics (crates.io) = 0.0.3; libcrux-ml-dsa (crates.io) = 0.0.3; libcrux-ml-kem (crates.io) = 0.0.3.

**Is there a fix for This vulnerability?** A patch was published on 2025-11-03: Fix merged in PR #1222; version 0.0.4 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run libcrux-intrinsics (crates.io), libcrux-ml-dsa (crates.io) or libcrux-ml-kem (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a cryptographic calculation error (CWE-327) in the ARM64 fallback implementation of the vxarq_u64 intrinsic within libcrux-intrinsics. On aarch64 platforms without native vxarq_u64 support, the fallback function passed incorrect operands to shift operations, producing corrupted results. This affected SHA-3 digest computation and cryptographic sampling in ML-KEM (key encapsulation) and ML-DSA (digital signature) modules, yielding incorrect shared secrets and invalid signatures. The attack is network-accessible with no authentication or user interaction required (CVSS 8.8, vector AV:N/AC:L/AT:N/PR:N/UI:N). The fix was applied in libcrux-intrinsics v0.0.4.

## Affected products

- cryspen libcrux-intrinsics 0.0.3
- cryspen libcrux-ml-kem 0.0.3
- cryspen libcrux-ml-dsa 0.0.3

## Timeline

- 2025-12-04: disclosed: Published to GitHub Advisory Database
- 2025-11-03: patched: Fix merged in PR #1222; version 0.0.4 released

## References

- [https://github.com/cryspen/libcrux/issues/1220](https://github.com/cryspen/libcrux/issues/1220)
- [https://github.com/cryspen/libcrux/pull/1222](https://github.com/cryspen/libcrux/pull/1222)
- [https://github.com/cryspen/libcrux/commit/8d10f45631afd1d93fabb2278dbb388a075b5608](https://github.com/cryspen/libcrux/commit/8d10f45631afd1d93fabb2278dbb388a075b5608)
- [https://rustsec.org/advisories/RUSTSEC-2025-0133.html](https://rustsec.org/advisories/RUSTSEC-2025-0133.html)

## Related threats

- [cryspen libcrux-ml-dsa signature verification bypass on AVX2 platforms](https://junglewise.ai/threats/cryspen-libcrux-ml-dsa-signature-verification-bypass-on-avx2-platforms-ba901d71)
- [RUSTSEC-2026-0125 - Signature Verification on AVX2 Platforms Mishandles Edge Case](https://junglewise.ai/threats/rustsec-2026-0125-signature-verification-on-avx2-platforms-mishandles-af596627)
- [RUSTSEC-2026-0126 - AVX2 Implementation Did Not Fully Reduce Intermediate Values](https://junglewise.ai/threats/rustsec-2026-0126-avx2-implementation-did-not-fully-reduce-intermediate-50fee9b7)
- [libcrux has an Incorrect Check of Signer Response Norm During Verification](https://junglewise.ai/threats/libcrux-has-an-incorrect-check-of-signer-response-norm-during-d5edfd19)
- [libcrux: Panic in Signature Hint Decoding During Verification](https://junglewise.ai/threats/libcrux-panic-in-signature-hint-decoding-during-verification-e5c48417)