Non-Canonical Field Element Vulnerability in WolfSSL's X25519 Implementation

CVE-2026-10512

What is CVE-2026-10512?

An implementation flaw in the X25519 assembly of wolfSSL's library may result in field elements not being fully reduced to their canonical form. This issue arises during the final modular reduction, where the most significant bit is not cleared properly, potentially leading to incorrect outcomes in scalar multiplication and shared secret generation. Specifically, overflow in the carry-propagation chains within the x64 and AVX2 routines may result in leaving the 255-bit field element in a state that does not adhere to expected standards, thus compromising cryptographic operations.

References