CVE-2026-3503

MEDIUM

wolfCrypt - Fault Injection Attack on ML-DSA and ML-KEM on ARM

Title source: manual
STIX 2.1

Description

Protection mechanism failure in wolfCrypt post-quantum implementations (ML-KEM and ML-DSA) in wolfSSL on ARM Cortex-M microcontrollers allows a physical attacker to compromise key material and/or cryptographic outcomes via induced transient faults that corrupt or redirect seed/pointer values during Keccak-based expansion. This issue affects wolfSSL (wolfCrypt): commit hash d86575c766e6e67ef93545fa69c04d6eb49400c6.

References (1)

Core 1
Core References
X_Refsource_Confirm x_refsource_confirm
https://github.com/wolfSSL/wolfssl/pull/9734

Scores

CVSS v3 5.2
EPSS 0.0015
EPSS Percentile 4.8%
Attack Vector PHYSICAL
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-335
Status published
Products (2)
wolfssl/wolfssl 5.8.2 - 5.9.0
wolfSSL Inc./wolfSSL (wolfCrypt) 5.8.2 - 5.9.0
Published Mar 19, 2026
Tracked Since Mar 20, 2026