A non‑constant‑time implementation of SM2 scalar multiplication on ARM64 and RISC‑V processors allows the time taken and cache‑access pattern during SM2 signing or decryption operations to depend on the bits of the secret scalar. An attacker capable of measuring these side‑channel traces can obtain information about the long‑term private key during decryption or the per‑signature nonce during signing, potentially leading to key compromise.

OpenSSL versions 4.0, 3.6, 3.5, and 3.4 running on AArch64 or RISC‑V are affected. The vulnerable variants require upgrading to 4.0.3, 3.6.5, 3.5.9, or 3.4.8 respectively. OpenSSL 3.0, 1.1.1, and 1.0.2 are not impacted.

The vulnerability has a CVSS score of 3.7, indicating moderate severity. EPSS information is not available and the issue is not listed in the CISA KEV catalog. Attackers would need the ability to measure precise operation timing or observe cache behaviour on an affected system, making mitigations such as operating in a protected environment or applying the vendor‑provided updates the most effective defence.