The vulnerability exists in the libcrux cryptographic library prior to certain patch releases. libcrux-ecdh fails to check the proper length and clamping of X25519 secrets, and its import validation is broken, which could allow an attacker to use an invalid key that bypasses security checks. libcrux-ed25519 performs a duplicate clamping operation during key generation, potentially creating weaker keys. libcrux-psq panics rather than reporting an AEADError, which could cause denial of service or unexpected termination of the calling application.

Affected products are the open-source library celabshq/libcrux and several of its sub-packages: libcrux-ecdh, libcrux-ed25519, and libcrux-psq. The vulnerability is present in all releases older than libcrux-ecdh 0.0.6, libcrux-ed25519 0.0.6, and libcrux-psq 0.0.7. No specific operating system or application is listed, so any environment that incorporates these library versions is potentially exposed.

The CVSS score of 8.7 classifies the issue as high severity, reflecting the significant impact on confidentiality and integrity if the vulnerability is exploited. The EPSS score is not available, and the vulnerability is not currently listed in CISA's KEV catalog. Because the flaw resides within cryptographic key handling, exploitation would likely require the ability to supply crafted keys or inputs to the affected library functions—an attack that could be possible from a remote client in a server application or from a local user on a system that loads the library. Given the high severity and the lack of a public exploit listing, administrators should treat this as a priority patching issue.