PT-2026-3893 · Sm-Crypto · Sm-Crypto

Xlabaiteam · Publicado 2026-01-21 · Atualizado 2026-02-25 · CVE-2026-23966

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions sm-crypto versions prior to 0.3.14

Description sm-crypto, a JavaScript library providing implementations of Chinese cryptographic algorithms SM2, SM3, and SM4, contains a flaw in the SM2 decryption logic. An attacker can recover the private key by repeatedly interacting with the SM2 decryption interface, requiring approximately several hundred interactions. This issue could compromise confidentiality.

Recommendations Versions prior to 0.3.14 should be updated to version 0.3.14 or later.

Exploit

Correção

Insufficient Verification of Data Authenticity

Enumeração de Fraquezas

CWE-345

Identificadores relacionados

CVE-2026-23966

GHSA-PGX9-497M-6C4V

Produtos afetados

Sm-Crypto

Referências · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23966.json · Exploit
• https://github.com/JuneAndGreen/sm-crypto/commit/b1c824e58fdf1eaa73692c124a095819a8c45707 · Correção
• https://github.com/JuneAndGreen/sm-crypto/security/advisories/GHSA-pgx9-497m-6c4v · Aviso do Fabricante
• https://github.com/JuneAndGreen/sm-crypto · Nota
• https://osv.dev/vulnerability/GHSA-pgx9-497m-6c4v · Aviso do Fabricante
• https://twitter.com/TheHackerWire/status/2014186817940340984 · Publicação no Twitter
• https://twitter.com/_cvereports/status/2014248533902213559 · Publicação no Twitter
• https://t.me/cveNotify/149514 · Publicação no Telegram
• https://twitter.com/pulsepatchio/status/2014348641981300957 · Publicação no Twitter
• https://twitter.com/0dayPublishing/status/2014166434784444684 · Publicação no Twitter
• https://t.me/CVEtracker/42723 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2014182487392768407 · Publicação no Twitter
• https://t.me/cveNotify/153163 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/2014243498623488097 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/2014181122343624855 · Publicação no Twitter