CVE-2026-32614: 
vulnerability analysis and mitigation

CVE-2026-32614 is an SM9 infinity-point ciphertext forgery vulnerability in the emmansun/gmsm Go library, a Chinese national standard cryptography implementation. The flaw allows an unauthenticated remote attacker to forge SM9 ciphertexts that successfully decrypt to attacker-chosen plaintext without possessing any secret key material. All versions of github.com/emmansun/gmsm prior to 0.41.1 are affected. The advisory was published on March 12, 2026, with NVD publication on March 16, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, GHSA).

The root cause is an incomplete validation of the elliptic-curve point C1 during SM9 decryption (CWE-347 / CWE-20). The implementation correctly checks that C1 can be deserialized and lies on the curve, but omits the mandatory SM9 standard requirement that C1 must not equal the group identity element (the point at infinity). When C1 is set to the all-zero infinity point, the bilinear pairing degenerates to the identity element in the GT group, making the KDF input fully predictable from only the target user's UID. An attacker can then independently compute the derived key material, construct a valid C2 (XOR-encrypted payload) and a passing C3 integrity hash (SM3), and deliver a fully forged ciphertext. The vulnerable code path is shared by sm9.Decrypt, sm9.DecryptASN1, and sm9.UnwrapKey, meaning both public-key encryption/decryption and key encapsulation/decapsulation are affected (GHSA).

The primary impact is a complete break of ciphertext authenticity and integrity for SM9-protected communications — an attacker can cause a recipient to accept and act upon attacker-chosen plaintext as if it were legitimately encrypted. No confidentiality loss or private key exposure occurs, as the attacker cannot decrypt genuine ciphertexts. In systems that treat successful SM9 decryption as implicit proof of sender authenticity, this vulnerability enables injection of forged business messages, instructions, notifications, or key material, potentially leading to downstream fraud, unauthorized actions, or compromise of dependent systems (GHSA).

A working proof-of-concept (PoC) is publicly included in the security advisory itself, demonstrating successful forgery using only the target UID. No authentication, master public key, or user private key is required, making exploitation trivially accessible to any network attacker. The EPSS score is approximately 0.009% (1st percentile), suggesting low observed exploitation probability in the near term. There is no current evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog (GitHub Advisory, GHSA).

1. Reconnaissance: Identify applications using github.com/emmansun/gmsm versions prior to 0.41.1 for SM9 encryption. Obtain the target recipient's UID (e.g., an email address or identifier used in the SM9 key generation process).
2. Construct infinity-point C1: Create a 64-byte all-zero byte slice representing the point at infinity on the SM9 elliptic curve (c1 := make([]byte, 64)).
3. Derive the forged key: Compute the KDF input as C1 || GT_identity.Marshal() || UID, where GT_identity is the identity element of the GT group (new(bn256.GT).SetOne()). Run sm3.Kdf(kdfInput, len(plaintext) + sm3.Size) to obtain the predictable key material.
4. Encrypt attacker-chosen plaintext: XOR the desired plaintext with key[:len(plaintext)] to produce C2.
5. Compute the integrity tag: Calculate C3 = SM3(C2 || key[len(plaintext):]) to produce a valid integrity hash.
6. Assemble and deliver forged ciphertext: Concatenate C1 || C3 || C2 and submit it to the target application's SM9 decryption endpoint (via sm9.Decrypt, sm9.DecryptASN1, or sm9.UnwrapKey).
7. Achieve forgery: The recipient's application decrypts the forged ciphertext successfully, recovering the attacker-chosen plaintext, and the C3 integrity check passes — the application accepts the message as authentic (GHSA).

• Network: Unexpected or anomalous SM9-encrypted messages delivered to recipients from unknown or untrusted senders, particularly where the sender cannot be verified through out-of-band means.
• Application Logs: Successful SM9 decryption events (sm9.Decrypt, sm9.DecryptASN1, sm9.UnwrapKey) where the originating ciphertext's C1 component is an all-zero 64-byte value; log entries showing decryption success for messages with no corresponding legitimate encryption event.
• File System / Data: Presence of forged plaintext content (e.g., unexpected instructions, key material, or notifications) that recipients acted upon but which cannot be traced to a legitimate sender.
• Cryptographic Artifacts: Ciphertexts where the first 64 bytes (C1 field) are all zeros (0x00...00), which is the serialized representation of the infinity point used in the attack (GHSA).

Upgrade github.com/emmansun/gmsm to version 0.41.1 or later, which adds an explicit rejection of the point at infinity in the shared UnwrapKey path used by all affected SM9 operations (sm9.Decrypt, sm9.DecryptASN1, sm9.UnwrapKey). The fix adds a check equivalent to if p.IsInfinity() { return nil, ErrDecryption } after successful deserialization and on-curve validation. No configuration-based workaround is available for unpatched versions; upgrading is the only remediation. After upgrading, verify that unit tests covering all-zero C1 rejection pass for raw, ASN.1, and UnwrapKey code paths (GitHub Release, GHSA).

The vulnerability was reported by researchers Cameudis and sunyxedu and was responsibly disclosed through GitHub's security advisory process by the library maintainer (emmansun). The advisory was well-received by the open-source community, with the v0.41.1 release garnering positive reactions on GitHub. No significant broader media coverage or notable public researcher commentary beyond the advisory itself has been identified.