CVE-2026-6330
MEDIUMML-KEM ARM64 NEON ciphertext comparison only compares half of the input
Title source: cnaExploitation Summary
EIP tracks 1 public exploit for CVE-2026-6330. PoCs published by 007bsd.
AI-analyzed exploit summary This repository contains a functional end-to-end key recovery exploit for CVE-2026-6330 and CVE-2026-10097, targeting ML-KEM implementations with side-channel vulnerabilities in AVX2 and NEON optimizations. The exploit leverages unchecked ciphertext coefficients to reconstruct private keys via linear regression on decryption oracle outputs.
Description
The ML-KEM ARM64 NEON ciphertext comparison only compares half of the input, breaking the Fujisaki-Okamoto transform's implicit rejection and weakening IND-CCA2 security on that code path. The constant-time comparison effectively ignored part of the re-encrypted ciphertext, so a decapsulating party could fail to detect a manipulated ciphertext and proceed without the standard's required implicit rejection.
Exploits (1)
This repository contains a functional end-to-end key recovery exploit for CVE-2026-6330 and CVE-2026-10097, targeting ML-KEM implementations with side-channel vulnerabilities in AVX2 and NEON optimizations. The exploit leverages unchecked ciphertext coefficients to reconstruct private keys via linear regression on decryption oracle outputs.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N