CVE-2026-10512
The X25519 x86_64 assembly implementation fails to clear the most significant bit during the final modular reduction, so the computed result may not be fully reduced modulo the field prime 2^255 - 19. This can leave the field element in a non-canonical form, producing an incorrect result from the scalar multiplication and potentially a wrong shared secret. The final carry-propagation chains in the x64 and AVX2 reduction routines could overflow into the top bit, and the high limb was not masked afterward, so the 255-bit field element was left non-canonical.
CSIRTS triage
- What
- The X25519 x86_64 assembly final reduction leaves a non-canonical field element.
- Who is affected
- Deployments using affected implementations of X25519.
- Urgency
- Remediation is high urgency due to the high severity of the issue.
- Action
- Update to a patched version for CVE-2026-10512.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-10512
Get an email if CVE-2026-10512 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.26% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 18% of all EPSS-scored CVEs.
Advisory coverage (2)
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-10512)