CVE-2025-14505

CVE-2025-14505 is a cryptographic vulnerability in the Elliptic package's ECDSA implementation, affecting all versions up to and including 6.6.1. It causes incorrect signature generation due to improper handling of leading zeros in an interim 'k' value, leading to truncation. This issue has a medium severity CVSS score of 5.6, indicating that an unauthenticated attacker could exploit it with high attack complexity to achieve low impacts on confidentiality, integrity, and availability. While there is no evidence of active exploitation, public exploit code, or significant community discussion, the vulnerability could allow attackers to derive secret keys under specific conditions.