HighPublic exploit

wolfSSL ML-KEM-1024 AVX2 Incomplete Ciphertext Comparison

IdentifiersCVE-2026-10097CWE-697· Incorrect Comparison

CVE-2026-10097 is an incorrect comparison in wolfSSL's x86-64 AVX2-optimized ML-KEM-1024 decapsulation implementation. The mlkem_cmp_avx2 routine compares only 1,536 of the required 1,568 ciphertext bytes during the Fujisaki-Okamoto re-encryption check, leaving the final 32 bytes unchecked. A ciphertext modified exclusively in those unchecked bytes can be accepted rather than triggering ML-KEM implicit rejection. This implementation flaw breaks the IND-CCA2 security property of affected ML-KEM-1024 deployments; ML-KEM itself is not mathematically broken.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

An attacker can submit ciphertexts that differ from the expected re-encryption solely in the unchecked final 32-byte region and cause decapsulation to return the genuine shared secret rather than the implicit-rejection secret. Where a plaintext-checking or decapsulation oracle reveals which result was produced and the same ML-KEM-1024 private key is reused, the flaw can expose linear information about secret-key coefficients and enable near-complete private-key recovery. A proof of concept recovered approximately 98% of the 2,048 secret coefficients using roughly 400 chosen ciphertexts against a vulnerable native AVX2 binary, with a substantially larger total decapsulation-query budget required for oracle construction and measurement.

Mitigation

If you can’t patch tonight, do this now.

Until patched, disable ML-KEM in affected wolfSSL builds or avoid the vulnerable x86-64 AVX2 ML-KEM-1024 code path where operationally feasible. Do not use static, long-lived, pinned, or otherwise reused ML-KEM-1024 private keys in exposed decapsulation services. Restrict access to decapsulation interfaces, prevent callers from distinguishing genuine and implicit-rejection shared-secret outcomes, and rate-limit decapsulation attempts. Fresh per-session ML-KEM keys reduce private-key recovery risk but do not correct the underlying IND-CCA2 failure.

Remediation

Patch, then assume compromise.

Upgrade wolfSSL to version 5.9.2 or later, which corrects the affected ML-KEM ciphertext-comparison defects. Validate the fix by mutating ciphertext bytes throughout the complete ML-KEM-1024 ciphertext, including its final 32 bytes, and confirming that every modification causes implicit rejection.

PUBLIC EXPLOITS

Exploits

1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.

VALID 1 / 1 TOTALView more in app

ml-kem-key-recoveryMaturityPoCVerified exploit

This repository is a real exploit/research repo for two wolfSSL ML-KEM-1024 vulnerabilities: CVE-2026-10097 (x86-64 AVX2) and CVE-2026-6330 (ARM64 NEON). Its purpose is not remote intrusion in the classic sense, but practical cryptographic key recovery from a vulnerable decapsulation oracle. The core capability is to exploit incomplete ciphertext comparison in wolfSSL’s Fujisaki-Okamoto implicit-rejection logic so that tampered ciphertexts are accepted if modifications fall in unchecked regions. The Python recovery harnesses then vary unchecked compressed v-coefficients, observe oracle output, reconstruct decryption-noise-related measurements, and solve a linear regression problem to recover the secret ML-KEM key coefficients. Repository structure is split into two parallel subtrees: avx2-cve-2026-10097/ and neon-cve-2026-6330/. Each contains README/reproduction docs, a C oracle implementation, a C sweep tool to identify unchecked ciphertext positions, and Python scripts for simulation, validation, and live recovery. The AVX2 subtree is the more complete analytical path, including RECOVERY_ANALYSIS.md and scripts verify_compressed.py, regress_compressed.py, test_harness.py, and live_recover_avx2.py. The NEON subtree mirrors the live attack flow with predict_unchecked.py, regress_neon.py, validate_neon.py, live_recover_neon.py, and a Dockerfile for ARM64/QEMU reproduction. Main exploit behavior: - wolf_oracle.c creates a persistent local ML-KEM-1024 decapsulation oracle using vulnerable wolfSSL code, exports public/private keys for scoring, and accepts ciphertexts over stdin. - sweep_implicit_reject.c and sweep_neon_fo.c confirm which ciphertext bytes are not checked by decapsulation. - live_recover_avx2.py and live_recover_neon.py perform the end-to-end attack by generating ciphertexts, modifying unchecked v-coefficients, querying the oracle repeatedly, deriving regression targets, and solving for the secret key. - regress_compressed.py and regress_neon.py simulate the same recovery offline against kyber-py models. - validate_neon.py is a lighter live validation script for the NEON case. Targeting details extracted from the code/docs: - Product: wolfSSL ML-KEM-1024 implementation before 5.9.2. - AVX2 bug: only bytes 1536-1567 of the 1568-byte ciphertext are unchecked, corresponding to v-coefficients 205-255. - NEON bug: approximately half the ciphertext is unchecked; predicted/validated v-coefficient bands are [52-101], [154-203], and [231-255]. - Reproduction uses pre-fix wolfSSL commit d278da09d. This is operational exploit code rather than mere detection: it includes a working oracle, live attack harnesses, and documented recovery results showing high-percentage or full recovery of ML-KEM secret coefficients under the stated conditions.

007bsdDisclosed Jul 22, 2026pythonclocalnetwork

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

WolfsslWolfsslapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

postquantumNews

Aug 17, 2026

wolfSSL ML-KEM Key Recovery Bug: What It Means for PQC

A high-severity wolfSSL AVX2 assembly implementation flaw in ML-KEM-1024's Fujisaki-Okamoto ciphertext comparison. It leaves the final 32 ciphertext bytes unchecked, enabling a chosen-ciphertext plaintext-checking oracle and near-complete private-key recovery against static reused ML-KEM keys.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity1

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2026-10097

NVD

nvd.nist.gov/vuln/detail/CVE-2026-10097

MITRE CWE · CWE-697

Incorrect Comparison

Patch

github.com/wolfSSL/wolfssl/pull/10430

Vendor Advisory

wolfssl.com/docs/security-vulnerabilities

wolfSSL ML-KEM-1024 AVX2 Incomplete Ciphertext Comparison

IdentifiersCVE-2026-10097CWE-697· Incorrect Comparison