mirage-crypto-ec EUVD-2026-74623

The target must run mirage-crypto-ec before 2.4.0 and expose NIST elliptic-curve scalar multiplication operations (ECDH key agreement or ECDSA signing) to an attacker who can trigger and precisely time a large number of operations - typically hundreds to thousands. This limits exploitation to scenarios where the attacker has persistent, low-latency network access to the service and can issue many requests without throttling or detection. If the EC operations are gated behind authentication, PR:L or PR:H would apply and exploitation is further constrained. The side channel is not exploitable via a single or small number of requests; statistical accumulation is mandatory, making automated bulk querying a prerequisite.

CVSS 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) accurately balances the severe potential impact (private key recovery) against the high attack complexity inherent to timing attacks. AC:H reflects that exploitation requires collecting hundreds to thousands of timing samples with sufficient resolution and applying statistical methods - techniques like lattice attacks on ECDSA nonces or flush-and-reload cache side-channels. No EPSS score was provided, limiting exploitation probability estimation. The absence of a KEV listing and no reported POC further supports treating this as a realistic but non-trivial threat. Real-world priority is highest for services exposing ECDH or ECDSA operations to untrusted networks (e.g., public TLS endpoints, signing APIs) since attacker-controlled request volume is a prerequisite. The fix is available in 2.4.0, making remediation straightforward.

An attacker targeting a public-facing TLS service built on mirage-crypto-ec before 2.4.0 repeatedly initiates ECDH handshakes, precisely measuring server response times across thousands of sessions. By correlating timing variations with guessed scalar bits and applying a lattice-based statistical attack, the attacker progressively narrows the private key until it is fully recovered, enabling passive session decryption or signature forgery.