CVE-2026-3503 — Fault injection attack with ML-DSA and ML-KEM on ARM

CVE-2026-3503

Fault injection attack with ML-DSA and ML-KEM on ARM PUBLISHED

Description (CNA)

Protection mechanism failure in wolfCrypt post-quantum implementations (ML-KEM and ML-DSA) in wolfSSL on ARM Cortex-M microcontrollers allows a physical attacker to compromise key material and/or cryptographic outcomes via induced transient faults that corrupt or redirect seed/pointer values during Keccak-based expansion. This issue affects wolfSSL (wolfCrypt): commit hash d86575c766e6e67ef93545fa69c04d6eb49400c6.

Affected (CNA)

Vendor / product	Versions
wolfSSL Inc. / wolfSSL (wolfCrypt)	affected 5.8.2 before 5.9.0

CWE

CWE-335

References

https://github.com/wolfSSL/wolfssl/pull/9734

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.