CVE-2026-54872 describes a timing side-channel vulnerability in the generic elliptic-curve scalar multiplication implementation used for ECDSA and SM2 signature operations on certain prime curves lacking dedicated constant-time implementations. The secret scalar (nonce) is padded using non-constant-time BIGNUM operations, causing timing variations dependent on the secret scalar value. An attacker capable of measuring signing times over many signatures may extract partial information about the secret nonce. Using lattice or Hidden Number Problem attacks, this can lead to private key recovery. The vulnerability is most pronounced on curves whose group order aligns with machine-word boundaries, such as brainpoolP384r1. NIST curves with dedicated constant-time implementations are unaffected. The FIPS-approved modules are not impacted as they use these dedicated implementations.

An attacker with the ability to measure the time taken for signature operations on vulnerable curves can gain partial information about the secret nonce used in ECDSA and SM2 signatures. Over many observations, this can enable recovery of the private key through advanced cryptanalysis techniques. The impact is limited to curves without dedicated constant-time implementations, notably brainpool curves, and does not affect widely used NIST curves or FIPS modules. The CVSS score is 3.7 (low), reflecting the difficulty of exploitation and limited scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability arises from the use of generic scalar multiplication implementations lacking constant-time behavior, mitigation involves updating cryptographic libraries to use dedicated constant-time implementations for affected curves or avoiding vulnerable curves altogether. Applications should prefer NIST curves P-256, P-384, and P-521, which are not affected. No known exploits are reported in the wild at this time.