The vulnerability in the GMSM SM9 implementation arises because the decryption routine accepts an elliptic‑curve point at infinity for the ciphertext component C1. This omission lets an attacker construct a ciphertext whose bilinear pairing result collapses to the identity element in the target group, causing a portion of the key derivation input to become a predictable constant. Using only the victim’s UID, an attacker can therefore derive the decryption key and forge a ciphertext that passes the integrity check. This is a ciphertext forgery flaw (CWE‑347) that compromises data confidentiality, allowing an attacker to decrypt or produce valid messages for the victim.

Affected products are the Go ShangMi cryptographic library (GMSM) from vendor emmansun. All releases prior to version 0.41.1 are vulnerable; version 0.41.1 and newer contain the fix.

The CVSS score of 7.5 indicates a high severity, while the EPSS score of less than 1% suggests that widespread exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to craft a malicious ciphertext, so it typically targets applications that consume SM9 encrypted data. If an attacker can supply the forged ciphertext to the victim’s software or intercept and replace existing ciphertext, decryption will succeed with the derived key, exposing the confidential content.