CVE-2026-77696

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. (affected versions not specified)

Description SM2 signature generation uses non-constant-time arithmetic on secret values, creating a timing side-channel. The process computes the signature value using variable-time BIGNUM operations on the private key and the secret nonce, meaning the time required to produce a signature depends on these secret values. An attacker capable of measuring signing times may obtain information about the per-signature secret nonce, which could lead to the recovery of the private key through a lattice or Hidden Number Problem attack.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.