PT-2026-52561 · Wolfssl · Wolfssl

Haruki Oyama · Published 2026-06-25 · Updated 2026-06-25 · CVE-2026-10512

NVD

CVSS v4.0

2.3

Low

Base vector

AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

The X25519 x86 64 assembly implementation fails to clear the most significant bit during the final modular reduction, so the computed result may not be fully reduced modulo the field prime 2^255 - 19. This can leave the field element in a non-canonical form, producing an incorrect result from the scalar multiplication and potentially a wrong shared secret. The final carry-propagation chains in the x64 and AVX2 reduction routines could overflow into the top bit, and the high limb was not masked afterward, so the 255-bit field element was left non-canonical.

Fix

Weakness Enumeration

CWE-682

Related Identifiers

CVE-2026-10512

Affected Products

Wolfssl

References · 3

• https://github.com/wolfSSL/wolfssl/pull/10536 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-10512 · Security Note
• https://wolfssl.com/docs/security-vulnerabilities · Note