CVE-2026-22699 affects RustCrypto Elliptic Curves library versions 0.14.0-pre.0 and 0.14.0-rc.0. A denial-of-service vulnerability exists in the SM2 PKE decryption path where invalid elliptic-curve points cause application panics. The vulnerability occurs when AffinePoint::from_encoded_point returns None for syntactically valid coordinates that don't lie on the SM2 curve, but the code uses unwrap() without proper checking. This results in panic conditions when malformed input is processed. The issue has been patched in commit 085b7be.