CVE-2026-3503
Medium · 5.2CVSS
5.2
EPSS
0.2%
Published
Mar 19, 2026
CISA due date
—
The record
Protection mechanism failure in wolfCrypt post-quantum implementations (ML-KEM and ML-DSA) in wolfSSL on ARM Cortex-M microcontrollers allows a physical attacker to compromise key material and/or cryptographic outcomes via induced transient faults that corrupt or redirect seed/pointer values during Keccak-based expansion. This issue affects wolfSSL (wolfCrypt): commit hash d86575c766e6e67ef93545fa69c04d6eb49400c6.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-11625 Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked… CWE-335
- CVE-2026-11702 Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state across… CWE-335
- CVE-2026-41564 CryptX versions before 0.088 for Perl do not reseed the Crypt::PK PRNG state after… CWE-335
- CVE-2026-25835 Mbed TLS before 3.6.6 and TF-PSA-Crypto before 1.1.0 misuse seeds in a Pseudo-Random… CWE-335
- CVE-2025-52578 Incorrect Usage of Seeds in Pseudo-Random Number Generator (CWE- 335) vulnerability in… CWE-335
- CVE-2024-55566 ColPack 1.0.10 through 9a7293a has a predictable temporary file (located under /tmp with… CWE-335
- CVE-2024-36048 QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x… CWE-335