CVE-2026-54579 Details
Description
mport is the MidnightBSD Package Manager. Prior to 2.7.8, ping() in libmport/ping.c accepted ICMP replies without validating icmp_id or icmp_seq and parsed the reply using a fixed IP-header offset instead of ip_hl. A network attacker able to inject or spoof visible ICMP replies could influence mirror latency selection, while a malformed packet carrying IP options could shift the ICMP header and trigger an out-of-bounds read. This issue is fixed in version 2.7.8.
A vulnerability exists in the MidnightBSD package manager, mport, in versions prior to 2.7.8. The issue arises in the ICMP ping response handling within libmport/ping.c, where the implementation fails to properly validate the ICMP identifier and sequence number. Instead, it uses a fixed offset for the IP header parsing, leading to potential out-of-bounds reads. This vulnerability allows a network attacker to spoof or inject ICMP replies, influencing the selection of mirror latency. Additionally, malformed packets with IP options could disrupt the ICMP header alignment, causing an out-of-bounds read.
Users can upgrade to mport version 2.7.8 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 17, 2026CISA-ADP
Assessed Sep 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MidnightBSD/mport/security/advisories/GHSA-qc2f-2j7j-m3r7 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
| CWE-345 | Insufficient Verification of Data Authenticity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| MidnightBSD mport | < 2.7.8 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | CVE Modified | CISA-ADP |
| Sep 17, 2026 | New CVE Received | [email protected] |