CVE-2025-14547 in Simplicity SDK
Summary
by MITRE • 02/20/2026
An integer underflow vulnerability is present in Silicon Lab’s implementation of PSA Crypto and SE Manager EC-JPAKE APIs during ZKP parsing. Triggering the underflow can lead to a hard fault, causing a temporary denial of service.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 02/20/2026
The integer underflow vulnerability identified as CVE-2025-14547 resides within Silicon Labs' implementation of the Platform Security Architecture Crypto and Secure Element Manager EC-JPAKE APIs. This flaw manifests specifically during the parsing of zero-knowledge proof components within the elliptic curve JPAKE (Joint Private Key Agreement) protocol implementation. The vulnerability stems from insufficient input validation and boundary checking when processing cryptographic parameters that are critical for secure key agreement operations. The affected code path processes mathematical values that should remain within defined positive integer ranges but fails to properly validate that these values do not fall below acceptable thresholds. This particular implementation flaw represents a classic example of CWE-191 Integer Underflow (Wrap or Wraparound) where arithmetic operations result in values that wrap around to negative numbers, causing unpredictable behavior in the cryptographic processing stack.
The operational impact of this vulnerability extends beyond simple denial of service conditions as it affects the fundamental security guarantees provided by the cryptographic protocols. When an attacker can trigger the integer underflow condition, the system experiences a hard fault that results in temporary service disruption. This disruption occurs because the cryptographic subsystem crashes and requires system restart or recovery mechanisms to restore normal operation. The vulnerability is particularly concerning in embedded systems and IoT devices where the affected components are often critical for device authentication and secure communication. The fault condition can be triggered through malformed cryptographic parameters that are passed to the EC-JPAKE API during the zero-knowledge proof validation process, making it exploitable through crafted inputs that manipulate the mathematical computations performed during key agreement. The vulnerability aligns with ATT&CK technique T1499.004 Network Denial of Service by creating conditions that can disrupt the availability of security services within the device.
Mitigation strategies for CVE-2025-14547 should focus on implementing comprehensive input validation and boundary checking mechanisms within the affected cryptographic APIs. System administrators and developers should ensure that all integer parameters passed to the EC-JPAKE implementation undergo strict validation before processing, particularly those values that determine loop iterations, buffer sizes, or mathematical operations within the zero-knowledge proof validation. The fix should include explicit checks to prevent negative values from being processed in arithmetic operations that could lead to underflow conditions. Additionally, defensive programming techniques such as using unsigned integer types where appropriate, implementing bounds checking, and adding overflow detection mechanisms should be employed. Organizations should also consider implementing runtime monitoring to detect anomalous behavior patterns that may indicate exploitation attempts. The vulnerability demonstrates the importance of robust error handling in cryptographic implementations and highlights the need for thorough security testing of mathematical operations within security-critical code paths. Updates to the Silicon Labs PSA Crypto and SE Manager components should be prioritized to address the root cause of the integer underflow condition, while also implementing proper logging and alerting mechanisms to detect potential exploitation attempts.