The vulnerability exists in the libcrux cryptographic library prior to certain patch releases. libcrux-ecdh fails to check the proper length and clamping of X25519 secrets, and its import validation is broken, which could allow an attacker to use an invalid key that bypasses security checks. libcrux-ed25519 performs a duplicate clamping operation during key generation, potentially creating weaker keys. libcrux-psq panics rather than reporting an AEADError, which could cause denial of service or unexpected termination of the calling application.

Affected products are the open-source library celabshq/libcrux and several of its sub-packages: libcrux-ecdh, libcrux-ed25519, and libcrux-psq. The vulnerability is present in all releases older than libcrux-ecdh 0.0.6, libcrux-ed25519 0.0.6, and libcrux-psq 0.0.7. No specific operating system or application is listed, so any environment that incorporates these library versions is potentially exposed.

The CVSS score of 8.7 classifies the issue as high severity, reflecting the significant impact on confidentiality and integrity if the vulnerability is exploited. The EPSS score is <1%, indicating a very low likelihood of exploitation, and the vulnerability is not listed in CISA's KEV catalog. Based on the description, it is inferred that the exploit would require supplying crafted keys or inputs to the affected library functions, which could be facilitated by a remote client in a server application or by a local user on a system that loads the library. Given the high severity and the very low EPSS probability, administrators should treat this as a priority patching issue.