CVE-2026-32614: GMSM Library Privilege Escalation Issue

CVE-2026-32614 Overview

Go ShangMi (Commercial Cryptography) Library (GMSM) is a widely-used cryptographic library implementing Chinese commercial cryptographic public algorithms including SM2/SM3/SM4/SM9/ZUC. A critical cryptographic vulnerability has been discovered in the SM9 decryption implementation prior to version 0.41.1. The vulnerability allows attackers to forge ciphertexts that pass integrity checks by exploiting improper validation of elliptic-curve points during the decryption process.

Critical Impact

An attacker who only knows the target user's UID can derive decryption key material and forge ciphertexts that pass integrity validation, completely undermining the cryptographic guarantees of SM9 encryption.

Affected Products

• Go ShangMi (GMSM) Library versions prior to 0.41.1
• Applications using GMSM SM9 decryption functionality
• Systems implementing Chinese commercial cryptographic standards via GMSM

Discovery Timeline

• 2026-03-16 - CVE CVE-2026-32614 published to NVD
• 2026-03-16 - Last updated in NVD database

Technical Details for CVE-2026-32614

Vulnerability Analysis

This vulnerability is classified as CWE-347 (Improper Verification of Cryptographic Signature), representing a fundamental flaw in the cryptographic protocol implementation. The SM9 decryption routine fails to properly validate the elliptic-curve point C1 contained within ciphertexts, specifically neglecting to reject the point at infinity.

When C1 is the point at infinity, the bilinear pairing computation degenerates into the identity element in the GT group. This mathematical degradation transforms a critical part of the key derivation input into a predictable constant value, eliminating the cryptographic randomness that should protect the decryption process.

The practical impact is severe: an attacker possessing only the target user's UID (User Identifier) can deterministically derive the key material used in decryption. With this derived key material, the attacker can construct forged ciphertexts that successfully pass the library's integrity verification checks.

Root Cause

The root cause lies in incomplete input validation during the SM9 decryption process. While the implementation correctly deserializes the elliptic-curve point C1 from the ciphertext and verifies that it lies on the curve, it fails to implement the critical check that explicitly rejects the point at infinity. This oversight violates the mathematical assumptions underlying the security of the SM9 identity-based encryption scheme.

Attack Vector

The attack is network-accessible and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Obtaining the target user's public UID (which is often publicly known in identity-based encryption systems)
2. Constructing a malicious ciphertext with C1 set to the point at infinity
3. Computing the predictable key derivation material that results from the degenerate pairing
4. Forging a complete ciphertext including valid integrity tag that will be accepted by the victim's decryption routine

The vulnerability mechanism can be understood through the SM9 decryption flow: during normal operation, the bilinear pairing e(C1, PrivateKey) produces a group element that depends on both the ciphertext and the recipient's private key. When C1 is the point at infinity, this pairing degenerates to the identity element, removing the dependency on the private key and making the derived key material predictable to anyone who knows the UID.

For complete technical details, see the GitHub Security Advisory.

Detection Methods for CVE-2026-32614

Indicators of Compromise

• Unexpected or malformed ciphertexts being processed by SM9 decryption functions
• Ciphertexts containing elliptic-curve points that serialize to the point at infinity representation
• Anomalous patterns in decryption logs where ciphertexts from unknown sources are being accepted
• Applications accepting ciphertexts that should have failed cryptographic validation

Detection Strategies

• Implement application-level logging to capture and analyze incoming ciphertexts before decryption
• Monitor for anomalous patterns in cryptographic operations, particularly repeated decryption attempts with similar malformed inputs
• Deploy integrity monitoring to detect unauthorized modifications to GMSM library files
• Use dependency scanning tools to identify applications running vulnerable GMSM versions prior to 0.41.1

Monitoring Recommendations

• Enable verbose logging in applications using GMSM SM9 functionality to capture decryption events
• Implement alerting for applications processing ciphertexts from untrusted sources
• Monitor software composition analysis (SCA) tools for vulnerable GMSM dependency versions
• Establish baseline behavior for SM9 decryption operations to detect anomalous activity

How to Mitigate CVE-2026-32614

Immediate Actions Required

• Upgrade GMSM library to version 0.41.1 or later immediately
• Audit all applications using GMSM SM9 decryption to identify vulnerable deployments
• Review any ciphertexts processed during the vulnerable period for potential forgery attempts
• Implement additional input validation at the application layer as defense-in-depth

Patch Information

The vulnerability has been addressed in GMSM version 0.41.1. The fix implements explicit validation to reject the point at infinity in the C1 component of SM9 ciphertexts during decryption. Organizations should update their Go module dependencies to include the patched version.

For Go modules, update your go.mod file to require version 0.41.1 or later:

require github.com/emmansun/gmsm v0.41.1

For additional details on the security fix, refer to the GitHub Security Advisory.

Workarounds

• If immediate upgrade is not possible, implement application-level validation to check that C1 is not the point at infinity before passing ciphertexts to SM9 decryption
• Temporarily disable SM9 decryption functionality in critical systems until the patch can be applied
• Implement additional cryptographic verification at the application layer to detect forged ciphertexts
• Restrict network access to systems processing SM9 encrypted data to trusted sources only

# Update GMSM dependency to patched version
go get github.com/emmansun/gmsm@v0.41.1

# Verify the installed version
go list -m github.com/emmansun/gmsm

# Run tests to ensure compatibility after upgrade
go test ./...