CVE-2026-1229CWE-682

Incorrect calculation in CIRCL secp384r1 CombinedMult

Low · published February 24, 2026

CVSS v4.0
2.9
EPSS
0%
Percentile
35.8
In the wild
Unconfirmed
What it is

The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an incorrect value for specific inputs. The issue is fixed by using complete addition formulas.

ECDH and ECDSA signing relying on this curve are not affected.

The bug was fixed in v1.6.3 https://github.com/cloudflare/circl/releases/tag/v1.6.3 .

The record
Technical detail
CVSS v4.0
2.9 · LOW
Vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/S:N/AU:Y/U:Amber
EPSS
0.00426 · 35.8th percentile
Weakness
CWE-682 · Incorrect Calculation
Published
2026-02-24T07:58Z
EPSS history
Timeline
  • 24 FEB 07:58Z
    Incorrect calculation in CIRCL secp384r1 CombinedMult
    cvelistv5