CVE-2026-10097 ML-KEM-1024 x64 AVX2 incomplete cipher text comparison enables IND-CCA2 break and static private-key recovery
Attackers can recover static private keys by exploiting incomplete ciphertext comparison in wolfSSL's ML-KEM-1024 AVX2 implementation via chosen ciphertext attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-10097?
CVE-2026-10097 is a high-severity vulnerability in Wolfssl Wolfssl, published on 25 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
wolfSSL's AVX2-optimized ML-KEM implementation (mlkem_cmp_avx2) compares only 1536 of the 1568 ciphertext bytes during the Fujisaki-Okamoto re-encryption check in ML-KEM-1024 decapsulation. Ciphertexts that differ from the expected re-encryption solely in bytes 1536-1567 bypass implicit rejection and are accepted as valid, breaking IND-CCA2 security. An attacker able to submit chosen ciphertexts to a decapsulation oracle that uses a static ML-KEM-1024 key, and to observe whether the genuine shared secret or the implicit-rejection secret was produced, can use this as a plaintext-checking oracle to recover the private key. A proof of concept recovered a full ML-KEM-1024 private key with approximately 98% success using roughly 350 chosen ciphertexts. The flaw is a deterministic logic error and does not rely on timing measurements.
Weakness: CWE-697
Which versions are affected by CVE-2026-10097?
It affects 1 product.
Products include Wolfssl Wolfssl.
How do I fix CVE-2026-10097?
Apply the vendor's patch.
Is CVE-2026-10097 being exploited?
There is no known exploitation of CVE-2026-10097 in the wild and no public exploit code.
Other vulnerabilities in Wolfssl Wolfssl
Sources
Also known as DEBIAN-CVE-2026-10097, GHSA-hcgc-hfp6-58v4, JLSEC-2026-693, UBUNTU-CVE-2026-10097.