CVE-2025-7396 — MEDIUM (4.6)

Vulnerability Description

In wolfSSL release 5.8.2 blinding support is turned on by default for Curve25519 in applicable builds. The blinding configure option is only for the base C implementation of Curve25519. It is not needed, or available with; ARM assembly builds, Intel assembly builds, and the small Curve25519 feature. While the side-channel attack on extracting a private key would be very difficult to execute in practice, enabling blinding provides an additional layer of protection for devices that may be more susceptible to physical access or side-channel observation.

CVSS Score

4.6

MEDIUM

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Wolfssl	Wolfssl	5.8.2

Related Weaknesses (CWE)

CWE-385

References

https://github.com/wolfSSL/wolfssl/blob/master/ChangeLog.md#wolfssl-release-582-Release Notes

FAQ

What is CVE-2025-7396?

CVE-2025-7396 is a vulnerability with a CVSS score of 4.6 (MEDIUM). In wolfSSL release 5.8.2 blinding support is turned on by default for Curve25519 in applicable builds. The blinding configure option is only for the base C implementation of Curve25519. It is not need...

How severe is CVE-2025-7396?

CVE-2025-7396 has been rated MEDIUM with a CVSS base score of 4.6/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2025-7396?

Check the references section above for vendor advisories and patch information. Affected products include: Wolfssl Wolfssl.