CVE-2026-54578

Published: Set 17, 2026 Last Modified: Set 18, 2026
ExploitDB:
Other exploit source:
Google Dorks:
LOW 2,0
Source: [email protected]
Attack Vector: local
Attack Complexity: low
Privileges Required: low
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A

Description

AI Translation Available

mport is the MidnightBSD Package Manager. Prior to 2.7.8, mport_verify_package() in libmport/verify.c could continue after MD5File() or SHA256_File() failed and compare an expected checksum with stale data in the hash buffer rather than a newly computed digest. An attacker able to influence an installed file or the conditions that make hashing fail could receive a misleading integrity result or hide a checksum failure. This issue is fixed in version 2.7.8.

354

Improper Validation of Integrity Check Value

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Integrity Other Non-Repudiation
Potential Impacts:
Modify Application Data Other Hide Activities
Applicable Platforms
All platforms may be affected
Likelihood of Exploit: Medium
View CWE Details
755

Improper Handling of Exceptional Conditions

Incomplete
Abstraction: Class Structure: Simple
Common Consequences
Security Scopes Affected:
Other
Potential Impacts:
Other
Applicable Platforms
All platforms may be affected
Likelihood of Exploit: Medium
View CWE Details
https://github.com/MidnightBSD/mport/commit/cd9991c3cc1f60e…
https://github.com/MidnightBSD/mport/commit/cd9991c3cc1f60ecb3f378852ad8b5caa82…
https://github.com/MidnightBSD/mport/pull/138
https://github.com/MidnightBSD/mport/pull/138
https://github.com/MidnightBSD/mport/releases/tag/2.7.8
https://github.com/MidnightBSD/mport/releases/tag/2.7.8
https://github.com/MidnightBSD/mport/security/advisories/GH…
https://github.com/MidnightBSD/mport/security/advisories/GHSA-hgmr-9p75-q5cg