Versions of the package fastecdsa before 2.3.2 are vulnerable to Use of Uninitialized Variable on the stack, via the curvemath_mul function in src/curveMath.c, due to being used and interpreted as user-defined type.
CVSS 3.1HIGH 7.5·Network·No auth·No interaction·EPSS 0.01025·Published 2024-02-24·Fixed in 2.3.2CWE-457