This vulnerability affects mkj Dropbear up to version 2025.89 and involves improper verification of cryptographic signatures in the unpackneg function within src/curve25519.c, specifically related to signature malleability. Although the vulnerability could theoretically be triggered remotely, the project maintainer clarifies that signature malleability is not exploitable in the SSH protocol itself. The complexity to exploit this issue is high, and no known proof-of-concept exists for the SSH implementation, only for the internal API. A patch with commit identifier fdec3c90a15447bd538641d85e5a3e3ac981011d is available to fix the vulnerability.

The vulnerability could allow an attacker to manipulate cryptographic signature verification, potentially undermining authentication processes. However, the maintainer states that this signature malleability is not exploitable in the SSH protocol, limiting practical impact. The attack complexity is high and exploitability is difficult, and no known exploits exist in the wild. Therefore, the real-world impact is likely low to medium, primarily theoretical without confirmed exploitation.

A patch identified by commit fdec3c90a15447bd538641d85e5a3e3ac981011d is available and recommended to address this vulnerability. Users should apply this patch to affected versions of mkj Dropbear up to 2025.89. The project maintainer indicates that the vulnerability is not exploitable in the SSH protocol, and no proof-of-concept exists for SSH, so immediate urgent action is not required beyond patching.