The vulnerability is a fault injection flaw in wolfSSL’s wolfCrypt post‑quantum implementations (ML‑KEM and ML‑DSA) on ARM Cortex‑M microcontrollers. A physical attacker can induce transient faults that corrupt or redirect seed or pointer values during the Keccak‑based expansion, allowing the attacker to compromise key material or alter cryptographic outcomes. This weakness aligns with CWE‑335, fault injection leading to integrity or confidentiality compromise.

WolfSSL (wolfCrypt) versions prior to commit d86575c766e6e67ef93545fa69c04d6eb49400c6 are affected. No specific version numbers are listed in the data; the commit hash indicates the code base where the flaw exists.

The CVSS score of 4.3 indicates low severity, but the exploit requires physical access to the Cortex‑M device to perform fault injections, making it a high‑effort attack for most adversaries. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. No publicly documented exploits are known. If physical proximity can be achieved, the attacker could gain access to sensitive keys or influence cryptographic operations, potentially compromising confidentiality or integrity.