The vulnerability occurs when a compiler rewrites a branchless selection used in the Montgomery ladder into a secret‑dependent branch during scalar multiplication in secp256k1-native. This introduces timing differences that correlate with bits of the scalar. An attacker who can measure the elapsed time of `Point#mul` or `scalar_multiply_ct` executions may recover each secret bit after many measurements, ultimately revealing a private key or nonce. The underlying weakness is a timing side‑channel (CWE‑1255) that breaks the constant‑time claim of the library (CWE‑208). The flaw does not affect the pure‑Ruby implementation, so the leak is limited to binaries compiled with GCC versions 14+ and 15+ at the default –O2 optimisation level.

The flaw affects the sgbett:secp256k1-native library used by Ruby applications. Versions released before 0.18.0, in particular 0.17.x and earlier, build with the extconf.rb script that appends –O2 and are susceptible when compiled with certain GCC toolchains. Systems that employ these libraries to perform cryptographic signing, key generation, or nonce multiplication in environments where an attacker can observe timing are at risk. Users relying on the pure‑Ruby path or on newer GCC versions that preserve constant‑time semantics are not impacted.

The CVSS score of 5.9 ranks the issue as medium severity. EPSS is not available, and the vulnerability is not listed in CISA KEV, suggesting limited public exploitation at this time. However, the flaw requires an environment that allows precise timing measurements; an attacker who can trigger the scalar multiplication repeatedly, perhaps in a networked service or a client‑side application, could statistically recover the secret bits. Because the compromise hinges on observable timing, it is harder to exploit than a direct code execution bug, but the information disclosed can lead to full key compromise. The risk level is moderate, with a likelihood that depends on the attacker’s ability to perform repeated measurements and subtle timing differences.