Which versions of Wolfssl Wolfcrypt are affected by CVE-2026-3503?

CVE-2026-3503 presents moderate security risk rated CVSS 4.3. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2026-3503?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Wolfssl Wolfcrypt CVE-2026-3503

Q: What is the CVSS score of CVE-2026-3503?

CVE-2026-3503 has a CVSS 4.0 base score of 4.3 (Medium). CVSS vector: CVSS:4.0/AV:P/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber. EPSS exploitation probability: 0.0%.

EUVD-2026-13149 MEDIUM

Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) (CWE-335)

2026-03-19 wolfSSL

Information Disclosure Wolfssl Wolfcrypt

4.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

CVSS:4.0/AV:P/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:P/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber

Attack Vector

Physical

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 19, 2026 - 19:00 euvd

EUVD-2026-13149

Analysis Generated

Mar 19, 2026 - 19:00 vuln.today

CVE Published

Mar 19, 2026 - 18:12 nvd

MEDIUM 4.3

DescriptionCVE.org

Protection mechanism failure in wolfCrypt post-quantum implementations (ML-KEM and ML-DSA) in wolfSSL on ARM Cortex-M microcontrollers allows a physical attacker to compromise key material and/or cryptographic outcomes via induced transient faults that corrupt or redirect seed/pointer values during Keccak-based expansion.

This issue affects wolfSSL (wolfCrypt): commit hash d86575c766e6e67ef93545fa69c04d6eb49400c6.

AnalysisAI

CVE-2026-3503 is a security vulnerability (CVSS 4.3) that allows a physical attacker. Remediation should follow standard vulnerability management procedures.

Technical ContextAI

Vulnerability type not specified by vendor.

RemediationAI

Monitor vendor channels for patch availability.

Same weakness CWE-335 – Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)

View all

CVE-2017-11519 CRITICAL POC

9.8

CVE-2021-41117 CRITICAL POC

9.1

CVE-2024-27632 HIGH POC

8.8

CVE-2016-10180 HIGH POC

7.5

CVE-2018-12520 HIGH POC

8.1

CVE-2017-5214 HIGH POC

7.5

CVE-2020-13784 HIGH POC

7.5

CVE-2024-36048 CRITICAL

9.8

Same technique Information Disclosure

View all

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

CVE-2023-7028 CRITICAL POC

10.0

CVE-2017-0213 HIGH POC

7.3

Vendor StatusVendor

Debian

wolfssl

Release	Status	Fixed Version	Urgency
bullseye	vulnerable	4.6.0+p1-0+deb11u2	-
bookworm	vulnerable	5.5.4-2+deb12u2	-
trixie	vulnerable	5.7.2-0.1+deb13u1	-
forky, sid	vulnerable	5.8.4-1	-
(unstable)	fixed	(unfixed)	-

CVE-2026-3503 vulnerability details – vuln.today

Back