CVE-2026-3503
March 19, 2026
Protection mechanism failure in wolfCrypt post-quantum implementations (ML-KEM and ML-DSA) in wolfSSL on ARM Cortex-M microcontrollers allows a physical attacker to compromise key material and/or cryptographic outcomes via induced transient faults that corrupt or redirect seed/pointer values during Keccak-based expansion.
This issue affects wolfSSL (wolfCrypt): commit hash d86575c766e6e67ef93545fa69c04d6eb49400c6.
Affected Packages
https://github.com/wolfSSL/wolfssl.git (GITHUB):
Affected version(s) >=v0.5 <v5.9.0-stableFix Suggestion:
Update to version v5.9.0-stableRelated Resources (1)
Do you need more information?
Contact UsCVSS v4
Base Score:
4.3
Attack Vector
PHYSICAL
Attack Complexity
HIGH
Attack Requirements
PRESENT
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
LOW
Vulnerable System Availability
NONE
Subsequent System Confidentiality
LOW
Subsequent System Integrity
LOW
Subsequent System Availability
NONE
CVSS v3
Base Score:
5.7
Attack Vector
PHYSICAL
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality
HIGH
Integrity
LOW
Availability
NONE
Weakness Type (CWE)
Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)
EPSS
Base Score:
0.02
