CVE-2021-36219

9.8 criticalEPSS 1.7%

Critical (9.8) in skale sgxwallet. EPSS 1.7% chance of exploitation in the next 30 days.

An issue was discovered in SKALE sgxwallet 1.58.3. The provided input for ECALL 14 triggers a branch in trustedEcdsaSign that frees a non-initialized pointer from the stack. An attacker can chain multiple enclave calls to prepare a stack that contains a valid address. This address is then freed, resulting in compromised integrity of the enclave. This was resolved after v1.58.3 and not reproducible in sgxwallet v1.77.0.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.7% chance of exploitation in the next 30 days; higher than 77% of CVEs (scores of 2026-10-31)
CWE: CWE-824
Published: 2021-09-27
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

skale:sgxwallet

References

https://github.com/skalenetwork/sgxwallet/commit/4e9b5b7526db083177e81f8bafeaa4914d276a82
https://github.com/skalenetwork/sgxwallet/releases
https://github.com/skalenetwork/sgxwallet/commit/4e9b5b7526db083177e81f8bafeaa4914d276a82
https://github.com/skalenetwork/sgxwallet/releases

Check your stack JSON