PT-2026-3892 · Sm-Crypto · Sm-Crypto

Xlabaiteam · Published 2026-01-21 · Updated 2026-02-25 · CVE-2026-23965

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions sm-crypto versions prior to 0.4.0

Description sm-crypto provides JavaScript implementations of Chinese cryptographic algorithms SM2, SM3, and SM4. A flaw exists in the SM2 signature verification logic that allows an attacker to forge valid signatures for arbitrary public keys under default configurations. If the message space has sufficient redundancy, the attacker can adjust the message prefix to meet specific formatting needs.

Recommendations Update to version 0.4.0 or later.

Exploit

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2026-23965

GHSA-HPWG-XG7M-3P6M

Affected Products

Sm-Crypto

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23965.json · Exploit
• https://github.com/JuneAndGreen/sm-crypto/security/advisories/GHSA-hpwg-xg7m-3p6m · Vendor Advisory
• https://github.com/JuneAndGreen/sm-crypto/commit/85295a859d0766222d12ce2be3e6fce7b438b510 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-23965 · Security Note
• https://osv.dev/vulnerability/CVE-2026-23965 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hpwg-xg7m-3p6m · Vendor Advisory
• https://github.com/JuneAndGreen/sm-crypto · Note
• https://t.me/cveNotify/153162 · Telegram Post
• https://twitter.com/CVEnew/status/2014182488403522031 · Twitter Post
• https://t.me/CVEtracker/42722 · Telegram Post
• https://t.me/cveNotify/149513 · Telegram Post
• https://twitter.com/cracbot/status/2016103975788150834 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2014248618400649362 · Twitter Post