CVE-2025-12888 LOW

CVE-2025-12888: Constant Time Issue with Xtensa-based ESP32 and X22519

Vendor Wolfssl
Product wolfSSL
Weakness CWE-203
Published November 21, 2025
Last update December 8, 2025
View on NVD All CVEs

CVSS base score

1.0/10
Attack vector Physical
Attack complexity High
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:P/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N

What the vulnerability does

01Description

Vulnerability in X25519 constant-time cryptographic implementations due to timing side channels introduced by compiler optimizations and CPU architecture limitations, specifically with the Xtensa-based ESP32 chips. If targeting Xtensa it is recommended to use the low memory implementations of X25519, which is now turned on as the default for Xtensa.

Key dates

02Disclosure timeline

November 21, 2025 CVE published
December 8, 2025 Record updated