Executive Summary

CVE-2026-23966 is a critical vulnerability in the SM2 decryption logic of the sm-crypto JavaScript library (versions prior to 0.3.14). Due to insufficient verification of data authenticity during decryption, an attacker can interact multiple times with the SM2 decryption interface and fully recover the private key after approximately several hundred interactions. This flaw allows remote exploitation without any privileges or user interaction. [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to a complete compromise of the private key used in SM2 encryption, allowing an attacker to decrypt sensitive data, impersonate the key owner, and compromise the confidentiality and integrity of communications or data protected by the affected sm-crypto library. The attack requires no privileges and can be performed remotely with low complexity, making it highly dangerous. [1]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking the version of the sm-crypto library in use. Versions prior to 0.3.14 are vulnerable. There are no specific network detection commands provided, but verifying the library version in your environment is essential. Additionally, monitoring for unusual or repeated interactions with the SM2 decryption interface could indicate exploitation attempts. [1]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate step to mitigate this vulnerability is to upgrade the sm-crypto library to version 0.3.14 or later, which includes patches that add validation checks to prevent private key recovery attacks. These patches validate elliptic curve points and public keys during decryption and signature verification, aborting processing if invalid data is detected. [1, 2]

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an attacker to fully recover the private key used in SM2 decryption, which compromises the confidentiality and integrity of encrypted data. Such a compromise can lead to unauthorized data access and breaches, potentially violating data protection requirements under standards like GDPR and HIPAA that mandate strong cryptographic protections to safeguard sensitive information. Therefore, the vulnerability negatively impacts compliance with these regulations by undermining the security guarantees expected from cryptographic implementations. [1]

Useful 0 Not Useful 0