Implicit Rejection Failure in Fujisaki-Okamoto Transform of Fujitsu's ML-KEM-1024

CVE-2026-10097

What is CVE-2026-10097?

The Fujisaki-Okamoto transform implemented in Fujitsu's ML-KEM-1024 has a significant flaw due to an implicit rejection failure when utilizing AVX2 for constant-time ciphertext comparison. This issue arises during the decapsulation process, where the last 32 bytes of a 1568-byte ciphertext are not compared. As a result, an attacker could manipulate these final bytes, making it possible for the system to mistakenly deem the manipulated ciphertext as valid. This leads to the unauthorized retrieval of shared secrets, compromising the integrity and confidentiality of cryptographic operations.

References