CVE-2026-3503

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-3503
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-3503.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-3503
Downstream
Published
2026-03-19T18:12:26.909Z
Modified
2026-07-16T03:48:29.278016981Z
Severity
  • 4.3 (Medium) CVSS_V4 - CVSS:4.0/AV:P/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N/U:Amber CVSS Calculator
Summary
Fault injection attack with ML-DSA and ML-KEM on ARM
Details

Protection mechanism failure in wolfCrypt post-quantum implementations (ML-KEM and ML-DSA) in wolfSSL on ARM Cortex-M microcontrollers allows a physical attacker to compromise key material and/or cryptographic outcomes via induced transient faults that corrupt or redirect seed/pointer values during Keccak-based expansion.

This issue affects wolfSSL (wolfCrypt): commit hash d86575c766e6e67ef93545fa69c04d6eb49400c6.

Database specific 
{
    "cwe_ids": [
        "CWE-335"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3503.json",
    "cna_assigner": "wolfSSL"
}
References

Affected packages

Git / github.com/wolfssl/wolfssl

Affected ranges

Type
GIT
Repo
https://github.com/wolfssl/wolfssl
Events
Introduced
decea12e223869c8f8f3ab5a53dc90b69f436eb2
Fixed
922d04b3568c6428a9fb905ddee3ef5a68db3108
Database specific 
{
    "cpe": "cpe:2.3:a:wolfssl:wolfssl:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "5.8.2"
        },
        {
            "fixed": "5.9.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

v5.*
v5.8.2-stable
v5.8.4-stable
Other
wolfEntropy2d

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-3503.json"