OpenSSL CVE-2026-54872

Exploitation requires that the target performs elliptic-curve scalar multiplication on NON-NIST curves - the vulnerability is specific to non-NIST curve code paths, so deployments using only standard NIST curves (P-256/P-384/P-521) are not exposed. The attacker must be able to induce and precisely time many such operations, implying either local co-residency or a low-jitter network position (AC:H). No authentication (PR:N) or user interaction (UI:N) is needed, but the high-complexity statistical timing recovery, limited confidentiality impact (C:L), and dependence on the specific curve configuration sharply constrain realistic exploitation. Applies to OpenSSL branches 1.0.2 (<1.0.2zs), 1.1.1 (<1.1.1zj), 3.0 (<3.0.23), 3.4 (<3.4.8), 3.5 (<3.5.9), 3.6 (<3.6.5), and 4.0 (<4.0.3).

This is a low-priority issue despite affecting a ubiquitous library. All signals align toward low real-world risk: the vendor/NVD CVSS is 3.7 (Low) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N, meaning high attack complexity, only limited confidentiality impact, and no integrity or availability impact. CISA's SSVC framework reinforces this - Exploitation: none, Automatable: no, Technical Impact: partial. There is no KEV listing and no public exploit identified. As a CWE-208 timing side-channel in scalar multiplication for non-NIST elliptic curves, exploitation requires a co-located or precisely-instrumented attacker collecting large volumes of timing measurements against operations using specific (non-NIST) curves to statistically recover secret scalar bits - hence AC:H. The signals are consistent, not conflicting: high CVSS is not present here, and both CVSS and SSVC agree this is a theoretical/hardening-grade cryptographic weakness rather than an actively-threatening flaw. The one caveat is scope of impact: full private-key recovery would normally warrant C:H, but the vendor's C:L reflects that practical, repeatable key extraction over the network is not demonstrated - treat this as defense-in-depth hardening.

An attacker able to trigger many ECC operations on a vulnerable non-NIST curve (e.g., repeated TLS/crypto handshakes) and measure their timing with high precision attempts to build a statistical model of variable-time scalar multiplication to infer secret scalar bits. Because the leak is a small, noisy timing differential, the attacker needs many samples, low network jitter or local co-residency, and use of the affected curves. No public exploit code exists and CISA SSVC rates exploitation as 'none' and non-automatable.