CVE-2026-6330: WolfSSL ML-KEM ARM64 Ciphertext Validation Weakness

Technical summary

CVE-2026-6330 is a cryptographic weakness in WolfSSL's ML-KEM ARM64 NEON implementation affecting the Fujisaki-Okamoto transform's implicit rejection mechanism. The vulnerability stems from incomplete ciphertext comparison during decapsulation: the constant-time comparison function only validates half of the re-encrypted ciphertext, rather than the full length mandated by the standard. This partial validation breaks the IND-CCA2 (Indistinguishability under Chosen-Ciphertext Attack) security guarantee that the Fujisaki-Okamoto transform is supposed to provide. An attacker can craft a manipulated ciphertext that passes the flawed validation, causing the decapsulating party to derive a shared secret without executing the implicit rejection logic that would normally occur upon ciphertext mismatch.

Business impact

Applications relying on WolfSSL's ML-KEM on ARM64 processors lose cryptographic assurance against adaptive chosen-ciphertext attacks. This is particularly concerning for systems where ML-KEM is used for long-term key establishment in post-quantum contexts. The practical risk depends on threat model and deployment: if the library is used in scenarios where an attacker can observe decapsulation outcomes or inject ciphertexts, the weakened security could enable key recovery or other attacks. Organizations using WolfSSL for post-quantum-ready cryptography should prioritize assessment and patching to maintain the intended security properties.

Affected systems

WolfSSL versions with the vulnerable ML-KEM ARM64 NEON implementation are affected. The issue is specific to ARM64 architecture; x86 and other platforms are not impacted by this particular code path. Verify the exact affected version range against the vendor's security advisory. Any application embedding WolfSSL for ML-KEM key encapsulation on ARM64 systems (embedded devices, IoT, edge servers, or ARM-based cloud instances) should be assessed for this vulnerability.

Exploitability

The vulnerability does not appear on the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating no known public exploitation in the wild at this time. However, exploitability is not dependent on any user interaction or authentication; an attacker can trigger the flaw by sending a specially crafted ciphertext over the network. The attack requires knowledge of the cryptographic protocol and the specific code path, and the practical impact depends on how the decapsulation outcome influences downstream application logic. The attack surface exists wherever ML-KEM decapsulation is exposed to untrusted ciphertext inputs.

Remediation

Apply the security patch issued by WolfSSL that corrects the ARM64 NEON ciphertext comparison to validate the entire ciphertext length. Verify the patched version against the vendor advisory to confirm the fix is included. For deployments unable to patch immediately, consider disabling ML-KEM on ARM64 systems or using an alternative cryptographic library until a patch is available. Conduct a brief risk assessment to determine whether your application's threat model makes this flaw practically exploitable in your environment.

Patch guidance

Contact WolfSSL or consult their official security advisory for the exact patched version number that addresses this CVE. Apply the patch to all systems running WolfSSL with ML-KEM support on ARM64 processors. After patching, re-validate the implementation against the post-quantum standard (NIST FIPS 203 or equivalent) to ensure the Fujisaki-Okamoto transform is fully functional. Test in a non-production environment first, particularly if the library is deeply integrated into your cryptographic pipeline.

Detection guidance

Review your inventory for WolfSSL usage, focusing on ARM64 deployments. Examine application logs and network traffic for unusual patterns around cryptographic failures or unexpected decapsulation rejections (the implicit rejection should occur more frequently if the vulnerability is being exploited). Enable detailed logging in WolfSSL if possible to track ciphertext validation outcomes. Monitor for unexpected changes in shared secret derivation or key establishment failures. System-level monitoring of cryptographic operations using tools like auditd can help correlate suspicious activity, though the vulnerability itself does not produce obvious forensic artifacts.

Why prioritize this

Although the CVSS score is MEDIUM (6.5), this flaw directly undermines a core security property of post-quantum cryptography. The Fujisaki-Okamoto transform exists precisely to resist chosen-ciphertext attacks; bypassing it defeats a critical design goal. Prioritize this for patching above other MEDIUM-severity issues because: (1) it affects a forward-looking, standards-based cryptographic primitive; (2) the flaw is not exotic—it's a logic error in validation code; (3) WolfSSL is widely embedded in devices and software; and (4) while not currently exploited, the vulnerability is trivially triggerable by an attacker with network access. Organizations actively adopting post-quantum cryptography should treat this as high-priority.

Risk score, explained

CVSS 6.5 (MEDIUM) reflects the combination of network accessibility and low attack complexity balanced against limited direct impact on confidentiality and integrity of a single interaction. However, the score does not fully capture the cryptographic severity: the vulnerability weakens a security property (IND-CCA2) that underlies the entire Fujisaki-Okamoto transformation. In contexts where long-term secrecy or repeated key usage is critical, the practical risk may exceed the base CVSS. Security teams should apply domain-specific judgment and raise the priority if ML-KEM is central to their post-quantum strategy.

Frequently asked questions