PT-2025-29131

CVE-2025-52473

Publicado

2025-07-10

Atualizado

2026-09-21

Descrição por

CVSS 3.1

5.9

Média

MétricasAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: liboqs versions prior to 0.14.0

Description: liboqs is a C-language cryptographic library providing post-quantum cryptography algorithm implementations. Secret-dependent branches were identified in the HQC key encapsulation mechanism reference implementation when compiled with Clang at optimization levels above -O0. A proof-of-concept local attack exploits this secret-dependent information to recover the entire secret key.

Recommendations: Update to version 0.14.0 or later.

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Zhenzhi Lai

Zhiyuan Zhang

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor