CVE-2024-36405

CVE-2024-36405 is a control-flow timing leak in the liboqs C-language cryptographic library, specifically affecting the reference implementation of the Kyber key encapsulation mechanism when compiled with Clang 15-18 under certain optimization flags. This vulnerability allows a local attacker to fully leak the ML-KEM 512 secret key within approximately 10 minutes through end-to-end decapsulation timing measurements. Rated with a CVSS score of 7.5 (HIGH), it presents a significant risk due to its low attack complexity and high confidentiality impact. There is currently no evidence of active exploitation, public exploit code, or significant community discussion, and it is not listed on the CISA KEV catalog.