PT-2026-3892 · Sm-Crypto · Sm-Crypto

Xlabaiteam · Publicado 2026-01-21 · Atualizado 2026-02-25 · CVE-2026-23965

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions sm-crypto versions prior to 0.4.0

Description sm-crypto provides JavaScript implementations of Chinese cryptographic algorithms SM2, SM3, and SM4. A flaw exists in the SM2 signature verification logic that allows an attacker to forge valid signatures for arbitrary public keys under default configurations. If the message space has sufficient redundancy, the attacker can adjust the message prefix to meet specific formatting needs.

Recommendations Update to version 0.4.0 or later.

Exploit

Correção

Improper Verification of Cryptographic Signature

Enumeração de Fraquezas

CWE-347

Identificadores relacionados

CVE-2026-23965

GHSA-HPWG-XG7M-3P6M

Produtos afetados

Sm-Crypto

Referências · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23965.json · Exploit
• https://github.com/JuneAndGreen/sm-crypto/security/advisories/GHSA-hpwg-xg7m-3p6m · Aviso do Fabricante
• https://github.com/JuneAndGreen/sm-crypto/commit/85295a859d0766222d12ce2be3e6fce7b438b510 · Correção
• https://github.com/JuneAndGreen/sm-crypto · Nota
• https://t.me/cveNotify/153162 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2014182488403522031 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-23965 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-23965 · Aviso do Fabricante
• https://t.me/CVEtracker/42722 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-hpwg-xg7m-3p6m · Aviso do Fabricante
• https://t.me/cveNotify/149513 · Publicação no Telegram
• https://twitter.com/cracbot/status/2016103975788150834 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2014248618400649362 · Publicação no Twitter