Post-Quantum Implementation Vulnerability in wolfSSL for ARM Cortex-M Microcontrollers

CVE-2026-3503

What is CVE-2026-3503?

A significant vulnerability exists in the wolfCrypt post-quantum implementations (ML-KEM and ML-DSA) utilized in wolfSSL on ARM Cortex-M microcontrollers. This flaw enables a physical attacker to exploit transient faults, potentially leading to the compromise of cryptographic keys or the integrity of cryptographic outcomes. The attack involves inducing faults that can corrupt or improperly redirect critical seed or pointer values during the Keccak-based expansion process, thereby jeopardizing the reliability of cryptographic operations.

References