CVE-2026-3503: wolfSSL Post-Quantum Crypto Fault Injection on ARM Cortex-M

CVE-2026-3503 is a protection-mechanism failure in wolfSSL's wolfCrypt library: on ARM Cortex-M microcontrollers, a physical attacker with fault-injection (glitching) equipment can corrupt seed or pointer values during the Keccak-based expansion step used by the post-quantum ML-KEM and ML-DSA algorithms, potentially recovering key material; NVD has published its own Primary CVSS v3.1 score of 5.2 (medium).

CVE-2026-3503 (CWE-335, misuse of a PRNG seed per the CNA's weakness record) is a protection-mechanism failure in wolfSSL's wolfCrypt cryptography library. NVD's description states it affects "wolfCrypt post-quantum implementations (ML-KEM and ML-DSA) in wolfSSL on ARM Cortex-M microcontrollers," allowing "a physical attacker to compromise key material and/or cryptographic outcomes via induced transient faults that corrupt or redirect seed/pointer values during Keccak-based expansion" (NVD).

NVD has completed its own analysis and published a Primary CVSS v3.1 score of 5.2 (medium), vector CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N — physical attack vector, low complexity, no privileges or user interaction, high confidentiality impact, low integrity impact, no availability impact. wolfSSL's own CNA record ([email protected]) separately submitted a Secondary CVSS v4.0 score of 4.3 (medium), vector CVSS:4.0/AV:P/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/..., which rates attack complexity higher (physical attack requirements present) than NVD's v3.1 Primary rating; this page's headline score is NVD's own Primary v3.1 figure (NVD).

The flaw is a fault-injection (voltage or clock glitching) attack: it requires an attacker to have physical, hands-on access to the target chip and specialized equipment capable of inducing transient faults during execution — it cannot be triggered remotely over a network. The affected code is wolfSSL's implementation of ML-KEM (post-quantum key encapsulation, formerly CRYSTALS-Kyber) and ML-DSA (post-quantum digital signatures, formerly CRYSTALS-Dilithium) specifically as built for the ARM Cortex-M family of microcontrollers — the dominant MCU core used in IoT sensors, smart meters, building-automation controllers, medical devices, and other embedded products that are now starting to adopt post-quantum cryptography ahead of the EU Cyber Resilience Act and similar mandates. A successful glitch during the Keccak-based seed/pointer expansion step can corrupt or redirect internal state, potentially letting the attacker recover ML-KEM/ML-DSA key material from the device (wolfSSL/wolfssl pull request #9734, "ML-KEM/ML-DSA: harden against fault attacks").

wolfSSL's fix, merged via pull request #9734, hardens the affected routines against fault attacks; the vulnerable code window is wolfSSL 5.8.2 up to (not including) the 5.9.0 release that incorporates the hardening (wolfSSL/wolfssl pull request #9734).

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06 (released 2026-11-06), and FIRST scores the probability of exploitation at 0.00162 (5.450th percentile) as of 2026-11-06 — among the lower EPSS scores, consistent with an attack that requires physical possession of the device and specialized fault-injection hardware rather than remote network access (CISA KEV, FIRST EPSS).

Device makers shipping ARM Cortex-M products with wolfSSL's post-quantum ML-KEM/ML-DSA code, particularly in tamper-sensitive or physically-accessible deployments (metering, access control, field sensors), should update to wolfSSL 5.9.0 or later and, where key material value justifies it, pair the software fix with physical tamper-resistance measures.

• Protection-mechanism failure (CWE-335) in wolfCrypt's ML-KEM and ML-DSA post-quantum implementations on ARM Cortex-M microcontrollers: a physical attacker can induce transient faults that corrupt seed/pointer values during Keccak-based expansion, compromising key material. — NVD
• NVD Primary CVSS v3.1 score 5.2 (medium), vector CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N; wolfSSL's own CNA record separately submitted a Secondary CVSS v4.0 score of 4.3. — NVD
• Affects wolfSSL (wolfCrypt) versions 5.8.2 up to (not including) 5.9.0 on ARM platforms; fixed via pull request #9734 titled "ML-KEM/ML-DSA: harden against fault attacks", authored by SparkiDev. — wolfSSL/wolfssl GitHub pull request #9734
• Not present in the CISA KEV catalog as of catalog version 2026.11.06 (released 2026-11-06). — CISA KEV
• EPSS score is 0.00162 (5.450th percentile) as of 2026-11-06. — FIRST EPSS