---
id: CVE-2026-54875
title: |-
  Issue summary: A non-constant-time optimized implementation of scalar
  point multiplication is used for SM2 private key operations on ARM64 and
  RISC-V platforms.

  Impact summary: An attacker able to measure the time taken by, or to observ…
summary: |-
  Issue summary: A non-constant-time optimized implementation of scalar
  point multiplication is used for SM2 private key operations on ARM64 and
  RISC-V platforms.

  Impact summary: An attacker able to measure the time taken by, or to observ…
severity: low
cwe:
  - CWE-208
vendor: OpenSSL
product: OpenSSL
affected:
  - OpenSSL >= 4.0.0 < 4.0.3
  - OpenSSL >= 3.6.0 < 3.6.5
  - OpenSSL >= 3.5.0 < 3.5.9
  - OpenSSL >= 3.4.0 < 3.4.8
published: '2026-09-29'
updated: '2026-09-29'
sourceUpdated: '2026-09-29T16:17:08.920'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54875'
references:
  - url: >-
      https://github.com/openssl/openssl/commit/3f01bbc28f7e08211fcdc797fd43816504f94257
    label: openssl-security@openssl.org
  - url: >-
      https://github.com/openssl/openssl/commit/469f3e42629f4a0b5631796e20c66c92c138a3e8
    label: openssl-security@openssl.org
  - url: >-
      https://github.com/openssl/openssl/commit/9794ed473764839275cb701b4850f3c24d929c28
    label: openssl-security@openssl.org
  - url: >-
      https://github.com/openssl/openssl/commit/dddad955d5ff3e9507619cf4e0f13e9988e2197c
    label: openssl-security@openssl.org
  - url: 'https://openssl-library.org/news/secadv/20260929.txt'
    label: openssl-security@openssl.org
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-29T16:39:33.266Z'
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-29T17:17:05.164162Z'
cvssSource: adp
---

## Overview

Issue summary: A non-constant-time optimized implementation of scalar
point multiplication is used for SM2 private key operations on ARM64 and
RISC-V platforms.

Impact summary: An attacker able to measure the time taken by, or to observe
the cache-line access pattern of SM2 signing or decryption on an affected
platform can learn information about the secret scalar.

CWE: CWE-208: Observable Timing Discrepancy

Description: On ARM64 and RISC-V processors, the SM2 curve uses an optimized
scalar multiplication implementation whose conditional branches and table
look ups are chosen according to the bits of the secret scalar. The execution
time and the cache-access pattern therefore depend on the long-term private
key (during SM2 decryption) or the per-signature nonce (during SM2 signature
generation), forming a timing and cache side-channel.

FIPS Impact: no
SM2 is not a FIPS algorithm and the optimized SM2 implementation is not part
of the FIPS module.

OpenSSL 4.0, 3.6, 3.5 and 3.4 are vulnerable to this issue on AArch64 and
RISC-V.

OpenSSL 3.0, 1.1.1 and 1.0.2 are not affected by this issue.

OpenSSL 4.0 users should upgrade to OpenSSL 4.0.3.
OpenSSL 3.6 users should upgrade to OpenSSL 3.6.5.
OpenSSL 3.5 users should upgrade to OpenSSL 3.5.9.
OpenSSL 3.4 users should upgrade to OpenSSL 3.4.8.

This issue was reported on 2 May 2026 by Abhinav Agarwal.
It was independently reported on 6 June 2026 by Feng Xue.
The fix was developed by Igor Ustinov.

-- cut (non-publishing metadata for internal use) --
Reported by: Abhinav Agarwal, Feng Xue
Fixed by: Igor Ustinov

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.