CVE-2026-23965

CVE-2026-23965 is a signature forgery vulnerability in the sm-crypto library, affecting versions prior to 0.4.0, which implements Chinese cryptographic algorithms. This flaw allows an attacker to forge valid SM2 signatures for any public key, potentially enabling them to craft messages with specific prefixes if the message space is redundant. Rated 7.5 HIGH on the CVSS scale, it's a network-exploitable vulnerability with low attack complexity, leading to high integrity impact without requiring user interaction or privileges. While there is no evidence of active exploitation, no public exploit code, and it's not on the KEV catalog, the vulnerability has garnered significant community discussion, indicating awareness among security researchers.