PT-2025-29131

CVE-2025-52473

Published

2025-07-10

Updated

2026-09-21

Description by

CVSS 3.1

5.9

Medium

MetricsAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: liboqs versions prior to 0.14.0

Description: liboqs is a C-language cryptographic library providing post-quantum cryptography algorithm implementations. Secret-dependent branches were identified in the HQC key encapsulation mechanism reference implementation when compiled with Clang at optimization levels above -O0. A proof-of-concept local attack exploits this secret-dependent information to recover the entire secret key.

Recommendations: Update to version 0.14.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Zhenzhi Lai

Zhiyuan Zhang

Vendors

Affected products

Weakness enumeration

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor