PT-2026-26329 · Arm+1 · Arm Cortex-M+2

Published 2026-01-01 · Updated 2026-03-23 · CVE-2026-3503

Positive Technologies (AI Summary)

CVSS v3.1

5.2

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions wolfSSL (wolfCrypt) versions prior to commit hash d86575c766e6e67ef93545fa69c04d6eb49400c6

Description A protection mechanism failure exists in wolfCrypt post-quantum implementations (ML-KEM and ML-DSA) within wolfSSL on ARM Cortex-M microcontrollers. This allows a physical attacker to compromise key material and/or cryptographic outcomes. The attack involves inducing transient faults that corrupt or redirect seed/pointer values during Keccak-based expansion.

Recommendations Update wolfSSL (wolfCrypt) to a version with commit hash d86575c766e6e67ef93545fa69c04d6eb49400c6 or later.

Fix

Weakness Enumeration

CWE-335

Related Identifiers

CVE-2026-3503

Affected Products

Arm Cortex-M

Wolfcrypt

Wolfssl

References · 8

• https://github.com/wolfSSL/wolfssl/pull/9734 · Patch
• https://security-tracker.debian.org/tracker/CVE-2026-3503 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3503 · Security Note
• https://ubuntu.com/security/CVE-2026-3503 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-3503 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-3503 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-3503 · Security Note
• https://twitter.com/CVEnew/status/2036024188969050324 · Twitter Post