The SM2 Public Key Encryption implementation in RustCrypto Elliptic Curves mistakenly generates a 32‑bit nonce instead of the required 256 bits due to a unit mismatch. This severe entropy reduction collapses the expected 128‑bit security to a trivial 16‑bit level, making it practical for an attacker to recover the nonce and decrypt any ciphertext that has been encrypted with a public key. The vulnerability is classified as CWE‑331, a random number weakness that undermines cryptographic security.

Impact is limited to two pre‑release versions of the RustCrypto elliptic‑curves crate: 0.14.0‑pre.0 and 0.14.0‑rc.0. Systems that depend on these releases for SM2‑PKE functionality are affected, while later stabilized releases are presumed patched.

With a CVSS score of 8.7 the vulnerability is considered high severity, yet an EPSS score of < 1 % suggests that the likelihood of exploitation is currently low. It is not listed in the CISA KEV catalog. Attackers would need only the ciphertext and the public key; they can brute‑force the 16‑bit nonce space to recover the secret key or decrypt the message. The exploit requires no special privilege or privileged access and can be performed remotely by an external actor who can capture or generate ciphertexts. Entities that send or receive SM2‑PKE encrypted data should therefore prioritize remediation.