{"id":"CVE-2026-54875","summary":"Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V","details":"Issue summary: A non-constant-time optimized implementation of scalar\npoint multiplication is used for SM2 private key operations on ARM64 and\nRISC-V platforms.\n\nImpact summary: An attacker able to measure the time taken by, or to observe\nthe cache-line access pattern of SM2 signing or decryption on an affected\nplatform can learn information about the secret scalar.\n\nCWE: CWE-208: Observable Timing Discrepancy\n\nDescription: On ARM64 and RISC-V processors, the SM2 curve uses an optimized\nscalar multiplication implementation whose conditional branches and table\nlook ups are chosen according to the bits of the secret scalar. The execution\ntime and the cache-access pattern therefore depend on the long-term private\nkey (during SM2 decryption) or the per-signature nonce (during SM2 signature\ngeneration), forming a timing and cache side-channel.\n\nFIPS Impact: no\nSM2 is not a FIPS algorithm and the optimized SM2 implementation is not part\nof the FIPS module.\n\nOpenSSL 4.0, 3.6, 3.5 and 3.4 are vulnerable to this issue on AArch64 and\nRISC-V.\n\nOpenSSL 3.0, 1.1.1 and 1.0.2 are not affected by this issue.\n\nOpenSSL 4.0 users should upgrade to OpenSSL 4.0.3.\nOpenSSL 3.6 users should upgrade to OpenSSL 3.6.5.\nOpenSSL 3.5 users should upgrade to OpenSSL 3.5.9.\nOpenSSL 3.4 users should upgrade to OpenSSL 3.4.8.\n\nThis issue was reported on 2 May 2026 by Abhinav Agarwal.\nIt was independently reported on 6 June 2026 by Feng Xue.\nThe fix was developed by Igor Ustinov.\n\n-- cut (non-publishing metadata for internal use) --\nReported by: Abhinav Agarwal, Feng Xue\nFixed by: Igor Ustinov","modified":"2026-10-02T18:41:52.780751374Z","published":"2026-09-29T15:32:17.206Z","related":["SUSE-SU-2026:4414-1"],"database_specific":{"cna_assigner":"openssl","cwe_ids":["CWE-208"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54875.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54875.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54875"},{"type":"ADVISORY","url":"https://openssl-library.org/news/secadv/20260929.txt"},{"type":"FIX","url":"https://github.com/openssl/openssl/commit/3f01bbc28f7e08211fcdc797fd43816504f94257"},{"type":"FIX","url":"https://github.com/openssl/openssl/commit/469f3e42629f4a0b5631796e20c66c92c138a3e8"},{"type":"FIX","url":"https://github.com/openssl/openssl/commit/9794ed473764839275cb701b4850f3c24d929c28"},{"type":"FIX","url":"https://github.com/openssl/openssl/commit/dddad955d5ff3e9507619cf4e0f13e9988e2197c"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/openssl/openssl","events":[{"introduced":"11b7b6ea3b65a584e1d31408ed1bdb139465cffd"},{"introduced":"7b371d80d959ec9ab4139d09d78e83c090de9779"},{"introduced":"636dfadc70ce26f2473870570bfd9ec352806b1d"},{"introduced":"98acb6b02839c609ef5b837794e08d906d965335"},{"fixed":"af1775b60dfa141a4ad762585052cabeb9f37e9e"},{"fixed":"c8bd5a57108599ac650bbae77fcabe3109dab2e8"},{"fixed":"45e844fa2a14ec92d146bd8f5778ac130b6625fb"},{"fixed":"e72c946f6f6d94c8ba5119acb25340b7b6b2073f"},{"fixed":"3f01bbc28f7e08211fcdc797fd43816504f94257"},{"fixed":"469f3e42629f4a0b5631796e20c66c92c138a3e8"},{"fixed":"9794ed473764839275cb701b4850f3c24d929c28"},{"fixed":"dddad955d5ff3e9507619cf4e0f13e9988e2197c"}],"database_specific":{"extracted_events":[{"introduced":"4.0.0"},{"fixed":"4.0.3"},{"introduced":"3.6.0"},{"fixed":"3.6.5"},{"introduced":"3.5.0"},{"fixed":"3.5.9"},{"introduced":"3.4.0"},{"fixed":"3.4.8"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["openssl-3.4.7","openssl-3.5.8","openssl-3.6.4","openssl-4.0.2","openssl-3.4.6","openssl-3.5.7","openssl-3.6.3","openssl-4.0.1","openssl-4.0.0","openssl-3.4.5","openssl-3.5.6","openssl-3.6.2","openssl-3.4.4","openssl-3.5.5","openssl-3.6.1","3.4-POST-CLANG-FORMAT-WEBKIT","3.4-PRE-CLANG-FORMAT-WEBKIT","3.5-POST-CLANG-FORMAT-WEBKIT","3.5-PRE-CLANG-FORMAT-WEBKIT","3.6-POST-CLANG-FORMAT-WEBKIT","3.6-PRE-CLANG-FORMAT-WEBKIT","openssl-3.6.0","openssl-3.4.3","openssl-3.5.4","openssl-3.5.3","openssl-3.5.2","openssl-3.4.2","openssl-3.5.1","openssl-3.5.0","openssl-3.4.1","openssl-3.4.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54875.json","vanir_signatures_modified":"2026-10-01T08:05:49Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/openssl/openssl/commit/9794ed473764839275cb701b4850f3c24d929c28","target":{"function":"ecp_sm2p256_point_P_mul_by_scalar","file":"crypto/ec/ecp_sm2p256.c"},"deprecated":false,"digest":{"function_hash":"192882174743925825303621013029623919029","length":953},"id":"CVE-2026-54875-05265127","signature_type":"Function"},{"id":"CVE-2026-54875-092eb48c","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/469f3e42629f4a0b5631796e20c66c92c138a3e8","target":{"file":"crypto/ec/ecp_sm2p256.c"},"deprecated":false,"digest":{"line_hashes":["206829253307759955356275659743571287950","279610770272636468289002996199902582647","289528532121271710938923821843566900729","6064332372262816597853991469025137880","81332679395349007760087492628407517279","236670913035210384276375704932749266006","271609653263245764623816196355255507468","253836471654128669193064657503468526473","265746819837233341115629101215311700735","272572673333099700244139294713126171784","77135593377653623778753147892418248020","168316419939442299842930460091905767408","89441504341618399362989915717631898070","329724973464904756082148387446971135893","93474284542576554103977308502172543523","246003033830391207317351792866437236371","206346438681645610771781329049211672980","157484754646280469505021122219716794391","175151328999425608905496790968165319035","4862175752196276541758522962564108227","67034290941568459617515278135627559148","13119560769348399811749821054548593234","216894835015991333326346156685431860649","162105684147608685941057917907911397307","113670494673506737208362244200632006126","218300729067030193520725404683808327013","139846609095700397265907022215466492930","262770097836868425269095444268513115108","72008655348907471454861497429457278353","220991265157422613291616331332235565275","84404432752735954579178364369003103429","69217193734734004215678332913626717837","328405470363236568348146580123922520489","33734439513491800815175226022607731513","102766887000903729290061821270327351759","293257852172591496764104549306069846352","59332426125684639141451387489354503541","58456278319310944209543035383201157019","53780785053017655694721132395269574070","329220298919960847822740608201007835324","176923338728862565632951895387193162206","146435003063977506985016491981765112694","259883968634105613935039970897235019477","242349265022219252437158934355295904130","280885619566101827352259240778629623252","237985455243739113195127796720610699753","10060927024872665764188555873949343257","329680350656818016456043463443294828973","129419247283854850414764817206982226435","301950226202944683804158310986795002645","151800277000703170867504714951498914225","130061915967570190455423879566523277150","92478717761996441918964748901053272178","153414452654523707825233192754111692521","233030242264234802090504332541727802901","37208710073949950368454417565820160676","51564378866036057776690162562683233737","291693222336258579200873806031675678804","82391724194940134137044355542063938039","334468111222844054277068994630827731518","119835676851650133336961450714212492467","334319306857856782523636057180562285185","269764929096705234775717450235017306876","108258173086088435153697924474636050053","53863584940054207946607441511206133246","170463683211067003370203504177908659700","249436505719805347346921297416039149386","139573509732966693987588069068435857476","41642218412892579359991561083864681277","258062224288255906872983436554229457338","237932409040644229377188308034045277623","281498809991449084000109017161805162990","178661975234276434312102224266210174576","221870777997369696208210887087038857990","9722494354690023653835398077485236687","177348452443423776593369344748923590363","91945694192372853602628381180555090337","321757137150548922700592120351330571108","66849985677427218477522785439813565654","237311812586625036160169753056818932743","93209655161142379403605693842755594705","333983233596980214563691038053446909800","128091420454152442727550016430395511299","161300504627976918771328590265925448128","112483128618335323810638673897150017911","210901677073681136432586125211735328220","240490686293465656455712318826198707237","318539844121484033667275884319559803420","87383250134407548501007364385584121489","305407463024304548130196606906410878762","125889613736547561527197697668061113357","338086597360782941111831355229027533120","267935461887516977140826332811752615280","162291577843814230030762025865846334371","26956252544117500799536514513567083974","217816356531351022706605698957169036872","104218946084913306238917582512541705859","335827809769702286138851206426531329031","78027818691354476513298279028147323028","128611077869816995492091650807240754729","151347343468110208369874069952438620110","336986642935519759204870759597530049072","91743816900906194657621143701506322918","298601274210104727079918635428345351194","143679966359821640193144065433307060771","59299294973205812337928733280469558396","257076112533547774493553150260241337968","223910968677905262538130742109371299741","136823936623407196824899168344036985174","203705473463645155071796856350034797052","257368721528987807613565755938915595062","201104877691992659234806106195660574486","92593687317439496182829337703141855672","146985895163938333766645030015335774874","191825739325959090498559685474922817274","47210779209964033595972957834235623271","271300805781333765164178117263234775596","123741003565094116935172370142386179914","230894244128039433541268426028956200555","123193028379465216452289092072303515641"],"threshold":0.9}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/9794ed473764839275cb701b4850f3c24d929c28","target":{"file":"crypto/ec/ecp_sm2p256.c","function":"ecp_sm2p256_point_add"},"deprecated":false,"digest":{"length":1634,"function_hash":"74266678354164909296116407782750708435"},"id":"CVE-2026-54875-12858c5c"},{"deprecated":false,"digest":{"function_hash":"74266678354164909296116407782750708435","length":1634},"id":"CVE-2026-54875-1ca44b84","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/469f3e42629f4a0b5631796e20c66c92c138a3e8","target":{"file":"crypto/ec/ecp_sm2p256.c","function":"ecp_sm2p256_point_add"}},{"target":{"function":"ecp_sm2p256_point_G_mul_by_scalar","file":"crypto/ec/ecp_sm2p256.c"},"deprecated":false,"digest":{"function_hash":"153799971865821824738160636091746563991","length":739},"id":"CVE-2026-54875-2d148236","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/9794ed473764839275cb701b4850f3c24d929c28"},{"target":{"file":"crypto/ec/ecp_sm2p256.c","function":"ecp_sm2p256_point_add"},"deprecated":false,"digest":{"length":1634,"function_hash":"74266678354164909296116407782750708435"},"id":"CVE-2026-54875-3bcb1d7b","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/dddad955d5ff3e9507619cf4e0f13e9988e2197c"},{"digest":{"length":962,"function_hash":"271125889207675386815025906801974958960"},"id":"CVE-2026-54875-41b01cfb","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/3f01bbc28f7e08211fcdc797fd43816504f94257","target":{"function":"ecp_sm2p256_point_double","file":"crypto/ec/ecp_sm2p256.c"},"deprecated":false},{"source":"https://github.com/openssl/openssl/commit/9794ed473764839275cb701b4850f3c24d929c28","target":{"function":"ecp_sm2p256_point_double","file":"crypto/ec/ecp_sm2p256.c"},"deprecated":false,"digest":{"function_hash":"271125889207675386815025906801974958960","length":962},"id":"CVE-2026-54875-4ce63d05","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["206829253307759955356275659743571287950","279610770272636468289002996199902582647","289528532121271710938923821843566900729","6064332372262816597853991469025137880","81332679395349007760087492628407517279","236670913035210384276375704932749266006","271609653263245764623816196355255507468","253836471654128669193064657503468526473","265746819837233341115629101215311700735","272572673333099700244139294713126171784","77135593377653623778753147892418248020","168316419939442299842930460091905767408","89441504341618399362989915717631898070","329724973464904756082148387446971135893","93474284542576554103977308502172543523","246003033830391207317351792866437236371","206346438681645610771781329049211672980","157484754646280469505021122219716794391","175151328999425608905496790968165319035","4862175752196276541758522962564108227","67034290941568459617515278135627559148","13119560769348399811749821054548593234","216894835015991333326346156685431860649","162105684147608685941057917907911397307","113670494673506737208362244200632006126","218300729067030193520725404683808327013","139846609095700397265907022215466492930","262770097836868425269095444268513115108","72008655348907471454861497429457278353","220991265157422613291616331332235565275","84404432752735954579178364369003103429","69217193734734004215678332913626717837","328405470363236568348146580123922520489","33734439513491800815175226022607731513","102766887000903729290061821270327351759","293257852172591496764104549306069846352","59332426125684639141451387489354503541","58456278319310944209543035383201157019","53780785053017655694721132395269574070","329220298919960847822740608201007835324","176923338728862565632951895387193162206","146435003063977506985016491981765112694","259883968634105613935039970897235019477","242349265022219252437158934355295904130","280885619566101827352259240778629623252","237985455243739113195127796720610699753","10060927024872665764188555873949343257","329680350656818016456043463443294828973","129419247283854850414764817206982226435","301950226202944683804158310986795002645","151800277000703170867504714951498914225","130061915967570190455423879566523277150","92478717761996441918964748901053272178","153414452654523707825233192754111692521","233030242264234802090504332541727802901","37208710073949950368454417565820160676","51564378866036057776690162562683233737","291693222336258579200873806031675678804","82391724194940134137044355542063938039","334468111222844054277068994630827731518","119835676851650133336961450714212492467","334319306857856782523636057180562285185","269764929096705234775717450235017306876","108258173086088435153697924474636050053","53863584940054207946607441511206133246","170463683211067003370203504177908659700","249436505719805347346921297416039149386","139573509732966693987588069068435857476","41642218412892579359991561083864681277","258062224288255906872983436554229457338","237932409040644229377188308034045277623","281498809991449084000109017161805162990","178661975234276434312102224266210174576","221870777997369696208210887087038857990","9722494354690023653835398077485236687","177348452443423776593369344748923590363","91945694192372853602628381180555090337","321757137150548922700592120351330571108","66849985677427218477522785439813565654","237311812586625036160169753056818932743","93209655161142379403605693842755594705","333983233596980214563691038053446909800","128091420454152442727550016430395511299","161300504627976918771328590265925448128","112483128618335323810638673897150017911","210901677073681136432586125211735328220","240490686293465656455712318826198707237","318539844121484033667275884319559803420","87383250134407548501007364385584121489","305407463024304548130196606906410878762","125889613736547561527197697668061113357","338086597360782941111831355229027533120","267935461887516977140826332811752615280","162291577843814230030762025865846334371","26956252544117500799536514513567083974","217816356531351022706605698957169036872","104218946084913306238917582512541705859","335827809769702286138851206426531329031","78027818691354476513298279028147323028","128611077869816995492091650807240754729","151347343468110208369874069952438620110","336986642935519759204870759597530049072","91743816900906194657621143701506322918","298601274210104727079918635428345351194","143679966359821640193144065433307060771","59299294973205812337928733280469558396","257076112533547774493553150260241337968","223910968677905262538130742109371299741","136823936623407196824899168344036985174","203705473463645155071796856350034797052","257368721528987807613565755938915595062","201104877691992659234806106195660574486","92593687317439496182829337703141855672","146985895163938333766645030015335774874","191825739325959090498559685474922817274","47210779209964033595972957834235623271","271300805781333765164178117263234775596","123741003565094116935172370142386179914","230894244128039433541268426028956200555","123193028379465216452289092072303515641"],"threshold":0.9},"id":"CVE-2026-54875-60466c6e","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/9794ed473764839275cb701b4850f3c24d929c28","target":{"file":"crypto/ec/ecp_sm2p256.c"}},{"source":"https://github.com/openssl/openssl/commit/dddad955d5ff3e9507619cf4e0f13e9988e2197c","target":{"file":"crypto/ec/ecp_sm2p256.c","function":"ecp_sm2p256_point_P_mul_by_scalar"},"deprecated":false,"digest":{"function_hash":"192882174743925825303621013029623919029","length":953},"id":"CVE-2026-54875-64310bc7","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["206829253307759955356275659743571287950","279610770272636468289002996199902582647","289528532121271710938923821843566900729","6064332372262816597853991469025137880","81332679395349007760087492628407517279","236670913035210384276375704932749266006","271609653263245764623816196355255507468","253836471654128669193064657503468526473","265746819837233341115629101215311700735","272572673333099700244139294713126171784","77135593377653623778753147892418248020","168316419939442299842930460091905767408","89441504341618399362989915717631898070","329724973464904756082148387446971135893","93474284542576554103977308502172543523","246003033830391207317351792866437236371","206346438681645610771781329049211672980","157484754646280469505021122219716794391","175151328999425608905496790968165319035","4862175752196276541758522962564108227","67034290941568459617515278135627559148","13119560769348399811749821054548593234","216894835015991333326346156685431860649","162105684147608685941057917907911397307","113670494673506737208362244200632006126","218300729067030193520725404683808327013","139846609095700397265907022215466492930","262770097836868425269095444268513115108","72008655348907471454861497429457278353","220991265157422613291616331332235565275","84404432752735954579178364369003103429","69217193734734004215678332913626717837","328405470363236568348146580123922520489","33734439513491800815175226022607731513","102766887000903729290061821270327351759","293257852172591496764104549306069846352","59332426125684639141451387489354503541","58456278319310944209543035383201157019","53780785053017655694721132395269574070","329220298919960847822740608201007835324","176923338728862565632951895387193162206","146435003063977506985016491981765112694","259883968634105613935039970897235019477","242349265022219252437158934355295904130","280885619566101827352259240778629623252","237985455243739113195127796720610699753","10060927024872665764188555873949343257","329680350656818016456043463443294828973","129419247283854850414764817206982226435","301950226202944683804158310986795002645","151800277000703170867504714951498914225","130061915967570190455423879566523277150","92478717761996441918964748901053272178","153414452654523707825233192754111692521","233030242264234802090504332541727802901","37208710073949950368454417565820160676","51564378866036057776690162562683233737","291693222336258579200873806031675678804","82391724194940134137044355542063938039","334468111222844054277068994630827731518","119835676851650133336961450714212492467","334319306857856782523636057180562285185","269764929096705234775717450235017306876","108258173086088435153697924474636050053","53863584940054207946607441511206133246","170463683211067003370203504177908659700","249436505719805347346921297416039149386","139573509732966693987588069068435857476","41642218412892579359991561083864681277","258062224288255906872983436554229457338","237932409040644229377188308034045277623","281498809991449084000109017161805162990","178661975234276434312102224266210174576","221870777997369696208210887087038857990","9722494354690023653835398077485236687","177348452443423776593369344748923590363","91945694192372853602628381180555090337","321757137150548922700592120351330571108","66849985677427218477522785439813565654","237311812586625036160169753056818932743","93209655161142379403605693842755594705","333983233596980214563691038053446909800","128091420454152442727550016430395511299","161300504627976918771328590265925448128","112483128618335323810638673897150017911","210901677073681136432586125211735328220","240490686293465656455712318826198707237","318539844121484033667275884319559803420","87383250134407548501007364385584121489","305407463024304548130196606906410878762","125889613736547561527197697668061113357","338086597360782941111831355229027533120","267935461887516977140826332811752615280","162291577843814230030762025865846334371","26956252544117500799536514513567083974","217816356531351022706605698957169036872","104218946084913306238917582512541705859","335827809769702286138851206426531329031","78027818691354476513298279028147323028","128611077869816995492091650807240754729","151347343468110208369874069952438620110","336986642935519759204870759597530049072","91743816900906194657621143701506322918","298601274210104727079918635428345351194","143679966359821640193144065433307060771","59299294973205812337928733280469558396","257076112533547774493553150260241337968","223910968677905262538130742109371299741","136823936623407196824899168344036985174","203705473463645155071796856350034797052","257368721528987807613565755938915595062","201104877691992659234806106195660574486","92593687317439496182829337703141855672","146985895163938333766645030015335774874","191825739325959090498559685474922817274","47210779209964033595972957834235623271","271300805781333765164178117263234775596","123741003565094116935172370142386179914","230894244128039433541268426028956200555","123193028379465216452289092072303515641"]},"id":"CVE-2026-54875-6eb301ee","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/dddad955d5ff3e9507619cf4e0f13e9988e2197c","target":{"file":"crypto/ec/ecp_sm2p256.c"}},{"deprecated":false,"digest":{"function_hash":"153799971865821824738160636091746563991","length":739},"id":"CVE-2026-54875-6ed19755","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/dddad955d5ff3e9507619cf4e0f13e9988e2197c","target":{"file":"crypto/ec/ecp_sm2p256.c","function":"ecp_sm2p256_point_G_mul_by_scalar"}},{"deprecated":false,"digest":{"function_hash":"271125889207675386815025906801974958960","length":962},"id":"CVE-2026-54875-729dac4f","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/469f3e42629f4a0b5631796e20c66c92c138a3e8","target":{"file":"crypto/ec/ecp_sm2p256.c","function":"ecp_sm2p256_point_double"}},{"target":{"file":"crypto/ec/ecp_sm2p256.c","function":"ecp_sm2p256_point_G_mul_by_scalar"},"deprecated":false,"digest":{"length":739,"function_hash":"153799971865821824738160636091746563991"},"id":"CVE-2026-54875-8fd0d7ee","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/3f01bbc28f7e08211fcdc797fd43816504f94257"},{"deprecated":false,"digest":{"function_hash":"271125889207675386815025906801974958960","length":962},"id":"CVE-2026-54875-938ac5d8","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/dddad955d5ff3e9507619cf4e0f13e9988e2197c","target":{"function":"ecp_sm2p256_point_double","file":"crypto/ec/ecp_sm2p256.c"}},{"id":"CVE-2026-54875-98be16ae","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/3f01bbc28f7e08211fcdc797fd43816504f94257","target":{"file":"crypto/ec/ecp_sm2p256.c","function":"ecp_sm2p256_point_add"},"deprecated":false,"digest":{"function_hash":"74266678354164909296116407782750708435","length":1634}},{"signature_version":"v1","source":"https://github.com/openssl/openssl/commit/3f01bbc28f7e08211fcdc797fd43816504f94257","target":{"file":"crypto/ec/ecp_sm2p256.c","function":"ecp_sm2p256_point_P_mul_by_scalar"},"deprecated":false,"digest":{"function_hash":"192882174743925825303621013029623919029","length":953},"id":"CVE-2026-54875-a41b1407","signature_type":"Function"},{"digest":{"function_hash":"192882174743925825303621013029623919029","length":953},"id":"CVE-2026-54875-ae6db94c","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/469f3e42629f4a0b5631796e20c66c92c138a3e8","target":{"file":"crypto/ec/ecp_sm2p256.c","function":"ecp_sm2p256_point_P_mul_by_scalar"},"deprecated":false},{"id":"CVE-2026-54875-b509a542","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/3f01bbc28f7e08211fcdc797fd43816504f94257","target":{"file":"crypto/ec/ecp_sm2p256.c"},"deprecated":false,"digest":{"line_hashes":["206829253307759955356275659743571287950","279610770272636468289002996199902582647","289528532121271710938923821843566900729","6064332372262816597853991469025137880","81332679395349007760087492628407517279","236670913035210384276375704932749266006","271609653263245764623816196355255507468","253836471654128669193064657503468526473","265746819837233341115629101215311700735","272572673333099700244139294713126171784","77135593377653623778753147892418248020","168316419939442299842930460091905767408","89441504341618399362989915717631898070","329724973464904756082148387446971135893","93474284542576554103977308502172543523","246003033830391207317351792866437236371","206346438681645610771781329049211672980","157484754646280469505021122219716794391","175151328999425608905496790968165319035","4862175752196276541758522962564108227","67034290941568459617515278135627559148","13119560769348399811749821054548593234","216894835015991333326346156685431860649","162105684147608685941057917907911397307","113670494673506737208362244200632006126","218300729067030193520725404683808327013","139846609095700397265907022215466492930","262770097836868425269095444268513115108","72008655348907471454861497429457278353","220991265157422613291616331332235565275","84404432752735954579178364369003103429","69217193734734004215678332913626717837","328405470363236568348146580123922520489","33734439513491800815175226022607731513","102766887000903729290061821270327351759","293257852172591496764104549306069846352","59332426125684639141451387489354503541","58456278319310944209543035383201157019","53780785053017655694721132395269574070","329220298919960847822740608201007835324","176923338728862565632951895387193162206","146435003063977506985016491981765112694","259883968634105613935039970897235019477","242349265022219252437158934355295904130","280885619566101827352259240778629623252","237985455243739113195127796720610699753","10060927024872665764188555873949343257","329680350656818016456043463443294828973","129419247283854850414764817206982226435","301950226202944683804158310986795002645","151800277000703170867504714951498914225","130061915967570190455423879566523277150","92478717761996441918964748901053272178","153414452654523707825233192754111692521","233030242264234802090504332541727802901","37208710073949950368454417565820160676","51564378866036057776690162562683233737","291693222336258579200873806031675678804","82391724194940134137044355542063938039","334468111222844054277068994630827731518","119835676851650133336961450714212492467","334319306857856782523636057180562285185","269764929096705234775717450235017306876","108258173086088435153697924474636050053","53863584940054207946607441511206133246","170463683211067003370203504177908659700","249436505719805347346921297416039149386","139573509732966693987588069068435857476","41642218412892579359991561083864681277","258062224288255906872983436554229457338","237932409040644229377188308034045277623","281498809991449084000109017161805162990","178661975234276434312102224266210174576","221870777997369696208210887087038857990","9722494354690023653835398077485236687","177348452443423776593369344748923590363","91945694192372853602628381180555090337","321757137150548922700592120351330571108","66849985677427218477522785439813565654","237311812586625036160169753056818932743","93209655161142379403605693842755594705","333983233596980214563691038053446909800","128091420454152442727550016430395511299","161300504627976918771328590265925448128","112483128618335323810638673897150017911","210901677073681136432586125211735328220","240490686293465656455712318826198707237","318539844121484033667275884319559803420","87383250134407548501007364385584121489","305407463024304548130196606906410878762","125889613736547561527197697668061113357","338086597360782941111831355229027533120","267935461887516977140826332811752615280","162291577843814230030762025865846334371","26956252544117500799536514513567083974","217816356531351022706605698957169036872","104218946084913306238917582512541705859","335827809769702286138851206426531329031","78027818691354476513298279028147323028","128611077869816995492091650807240754729","151347343468110208369874069952438620110","336986642935519759204870759597530049072","91743816900906194657621143701506322918","298601274210104727079918635428345351194","143679966359821640193144065433307060771","59299294973205812337928733280469558396","257076112533547774493553150260241337968","223910968677905262538130742109371299741","136823936623407196824899168344036985174","203705473463645155071796856350034797052","257368721528987807613565755938915595062","201104877691992659234806106195660574486","92593687317439496182829337703141855672","146985895163938333766645030015335774874","191825739325959090498559685474922817274","47210779209964033595972957834235623271","271300805781333765164178117263234775596","123741003565094116935172370142386179914","230894244128039433541268426028956200555","123193028379465216452289092072303515641"],"threshold":0.9}},{"deprecated":false,"digest":{"function_hash":"153799971865821824738160636091746563991","length":739},"id":"CVE-2026-54875-bc6bb9d6","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/469f3e42629f4a0b5631796e20c66c92c138a3e8","target":{"file":"crypto/ec/ecp_sm2p256.c","function":"ecp_sm2p256_point_G_mul_by_scalar"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}