sm-crypto contains a signature malleability flaw in its SM2 signature verification routine that allows an attacker to compute a new valid signature from an existing one. The weakness enables forging of digital signatures, thereby undermining the authentication guarantees of any system that relies on SM2 signatures for integrity or authorization. This is a classic example of improper handling of signature malleability, classified as CWE-347.

The vulnerability applies to the Jun eAndGreen sm-crypto library in all releases prior to version 0.3.14. The affected product is the JavaScript implementation of Chinese cryptographic algorithms SM2, SM3, and SM4 provided by the JuneAndGreen sm-crypto repository. Upgrading to 0.3.14 or later addresses the issue.

The CVSS score of 7.5 places the flaw in the high‑severity range, reflecting a significant impact should it be exploited. The current EPSS score is below 1 %, indicating that exploitation attempts are unlikely at present, and the vulnerability is not listed in the CISA KEV catalog. It is inferred that an attacker would need possession of a valid SM2 signature and the corresponding message to craft a forged signature, making the attack more likely in controlled or offline environments where such credentials are available.