wolfSSL EUVD-2026-39552

Exploitation requires all of the following: (1) the target runs wolfSSL compiled for x86_64 with Curve25519 assembly acceleration enabled (HAVE_CURVE25519 and the x64 or AVX2 asm routines compiled from fe_x25519_asm.S); (2) the attacker can participate in an X25519 key exchange with the target as a TLS or other protocol peer; (3) the public key contributed by the attacker, when combined with the target's private scalar in the Montgomery ladder, produces a field element in [2^255−19, 2^255) - the narrow non-canonical range that the missing masking AND would have corrected. Builds using the portable C field arithmetic path are unaffected regardless of platform. The CVSS 4.0 AC:H and AT:P ratings confirm this is not a default-configuration mass-exploitation scenario; reliable triggering requires mathematical construction of appropriate edge-case inputs.

The vendor-assigned CVSS 4.0 score of 2.3 accurately reflects the narrow real-world risk. AC:H and AT:P confirm that triggering the non-canonical path requires specific scalar/point combinations that produce field results near a multiple of the prime; mass exploitation against arbitrary sessions is not feasible. The impact metrics (VA:L on the vulnerable system, all others N) indicate the primary consequence is protocol failure - mismatched shared secrets cause handshake errors - rather than key material disclosure or arbitrary code execution. No EPSS data is available in the provided intelligence, but the low CVSS score and absence from CISA KEV are consistent with a low exploitation probability. The security relevance is bounded: unless a higher-layer protocol exposes a side channel or insecure fallback when the key exchange fails, the flaw degrades availability rather than compromising confidentiality or integrity. No such chained scenario is supported by the available data. Overall this is a cryptographic correctness defect with limited security severity, prioritized for x86_64 wolfSSL deployments using the Curve25519 key-exchange path.

A network peer participating in an X25519-based key exchange (for example, TLS 1.3) with a wolfSSL x86_64 endpoint sends a crafted ephemeral public key selected so that the server's scalar multiplication result falls in the non-canonical range [2^255−19, 2^255). The wolfSSL endpoint computes a wrong shared secret due to the unmasked top bit; the derived session keys diverge from the peer's, and the handshake fails. Constructing a suitable public key requires non-trivial number-theoretic calculation, and no public exploit code has been identified at time of analysis.