CVE-2026-1229lowCWE-682

Incorrect calculation in CIRCL secp384r1 CombinedMult

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 2.9epss 0.4%

exploitation probability

0.4%top 68% of all CVEs

observed exploitation

nono source reports it

The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an incorrect value for specific inputs. The issue is fixed by using complete addition formulas. ECDH and ECDSA signing relying on this curve are not affected. The bug was fixed in v1.6.3 https://github.com/cloudflare/circl/releases/tag/v1.6.3 .

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/S:N/AU:Y/U:Amber

Affected products

Cloudflare · CIRCL

References

https://github.com/cloudflare/circl