CVE-2026-54875 affects multiple packages. Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private key operations on ARM64 and RISC-V platforms. See references for individual vulnerability details.