CVE-2025-66016 CGGMP24 is missing a check in the ZK proof used in CGGMP21
A missing check in the ZK proof allows a malicious signer to reconstruct the full private key in the CGGMP24 ECDSA TSS protocol.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-66016?
CVE-2025-66016 is a critical vulnerability in LFDT-Lockness cggmp21, published on 25 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
CGGMP24 is a state-of-art ECDSA TSS protocol that supports 1-round signing (requires 3 preprocessing rounds), identifiable abort, and a key refresh protocol. Prior to version 0.6.3, there is a missing check in the ZK proof that enables an attack in which single malicious signer can reconstruct full private key. This issue has been patched in version 0.6.3, for full mitigation it is recommended to upgrade to cggmp24 version 0.7.0-alpha.2 as it contains more security checks.
Weakness: CWE-345
Which versions are affected by CVE-2025-66016?
6 open source packages ship an affected version, including cggmp21 and cggmp24.
| Package | Affected | Fixed in |
|---|---|---|
cggmp21 crates.io | All versions | 0.6.3 |
cggmp21 crates.io | All versions | 0.6.3 |
cggmp21 crates.io | From 0.0.0-0 | 0.6.3 |
cggmp24 crates.io | All versions | 0.7.0-alpha.2 |
cggmp24 crates.io | All versions | 0.7.0-alpha.2 |
cggmp24 crates.io | From 0.0.0-0 | 0.7.0-alpha.2 |
How do I fix CVE-2025-66016?
Upgrade cggmp21 to 0.6.3 or later.
Is CVE-2025-66016 being exploited?
There is no known exploitation of CVE-2025-66016 in the wild and no public exploit code.
Sources
Also known as GHSA-m95p-425x-x889, RUSTSEC-2025-0129, RUSTSEC-2025-0130.