CVE-2026-3503 Fault injection attack with ML-DSA and ML-KEM on ARM

Medium 4.3 Published 19 Mar 2026 Updated 19 Mar 2026

Physical attackers can compromise cryptographic keys in wolfSSL on ARM Cortex-M devices via fault injection attacks during post-quantum operations.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-3503?

CVE-2026-3503 is a medium-severity vulnerability in Wolfssl Wolfssl, published on 19 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Protection mechanism failure in wolfCrypt post-quantum implementations (ML-KEM and ML-DSA) in wolfSSL on ARM Cortex-M microcontrollers allows a physical attacker to compromise key material and/or cryptographic outcomes via induced transient faults that corrupt or redirect seed/pointer values during Keccak-based expansion.

This issue affects wolfSSL (wolfCrypt): commit hash d86575c766e6e67ef93545fa69c04d6eb49400c6.

Weakness: CWE-335

Which versions are affected by CVE-2026-3503?

It affects 1 product.

Products include Wolfssl Wolfssl.

How do I fix CVE-2026-3503?

Apply the vendor's patch.

Is CVE-2026-3503 being exploited?

There is no known exploitation of CVE-2026-3503 in the wild and no public exploit code.

All Wolfssl Wolfssl vulnerabilities

Sources

Also known as DEBIAN-CVE-2026-3503, GHSA-pgc5-r6cv-2825, JLSEC-2026-705, UBUNTU-CVE-2026-3503.