The X25519 routine in the wolfSSL library contains an x86_64 assembly implementation that does not clear the most significant bit during the final modular reduction. As a result, the derived field element can remain non‑canonical, leading to an erroneous scalar multiplication result and a potentially wrong shared secret. This flaw is classified as a CWE‑682 vulnerability and could compromise the integrity of ECDH key exchanges when the affected code is executed.

The vulnerability impacts the wolfSSL library, specifically the X25519 implementation on x86_64 architectures. No specific version range is provided in the advisory, so any release that includes the described assembly routine may be affected.

The CVSS score of 2.3 indicates a low overall risk. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting limited known exploitation. The flaw is limited to scenarios where the vulnerable code is used for X25519 scalar multiplication; it does not provide arbitrary code execution. Exploitation would likely require influencing the scalar value or the library’s use in SSL/TLS handshakes, making the attack surface narrow and the probability of exploitation relatively low.