The ML-KEM-1024 x64 AVX2 implementation of the Fujisaki-Okamoto transform contains a flaw where the AVX2 constant-time ciphertext comparison used during decapsulation does not include the final 32-byte block of the 1568-byte ciphertext. Because of this, ciphertexts altered only in those final bytes compare as equal to the original, causing the decapsulation process to return the actual shared secret rather than performing the implicit rejection mandated by the IND-CCA2 security standard. This breaks the intended security guarantees of the scheme.

This vulnerability breaks the IND-CCA2 security property of the Fujisaki-Okamoto transform in the affected implementation, potentially allowing attackers to manipulate ciphertexts in a way that bypasses implicit rejection. As a result, decapsulation may return the real shared secret for manipulated ciphertexts, undermining the confidentiality guarantees of the cryptographic scheme. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided. Until a fix is available, users should avoid using the affected ML-KEM-1024 x64 AVX2 implementation or apply any vendor-recommended mitigations once published.