CVE-2026-26958 filippo.io/edwards25519 MultiScalarMult produces invalid results or undefined behavior if receiver is not the identity
The MultiScalarMult function in the edwards25519 Go library returns invalid results or undefined behavior when the receiver is not the identity point.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-26958?
CVE-2026-26958 is a low-severity vulnerability in FiloSottile filippo.io/edwards25519, published on 19 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with APIs for building cryptographic primitives. In versions 1.1.0 and earlier, MultiScalarMult produces invalid results or undefined behavior if the receiver is not the identity point. If (*Point).MultiScalarMult is called on an initialized point that is not the identity point, it returns an incorrect result. If the method is called on an uninitialized point, the behavior is undefined. In particular, if the receiver is the zero value, MultiScalarMult returns an invalid point that compares Equal to every other point. Note that MultiScalarMult is a rarely used, advanced API. For example, users who depend on filippo.io/edwards25519 only through github.com/go-sql-driver/mysql are not affected. This issue has been fixed in version 1.1.1.
Weakness: CWE-665
Which versions are affected by CVE-2026-26958?
3 open source packages ship an affected version, including filippo.io/edwards25519.
| Package | Affected | Fixed in |
|---|---|---|
filippo.io/edwards25519 Go | All versions | 1.1.1 |
filippo.io/edwards25519 Go | All versions | 1.1.1 |
filippo.io/edwards25519 Go | All versions | 1.1.1 |
How do I fix CVE-2026-26958?
Upgrade filippo.io/edwards25519 to 1.1.1 or later.
Is CVE-2026-26958 being exploited?
There is no known exploitation of CVE-2026-26958 in the wild and no public exploit code.
Sources
Also known as AZL-78123, AZL-78216, CLEANSTART-2026-OU79790, CLEANSTART-2026-RM10286, CLEANSTART-2026-SU88556, CLEANSTART-2026-UP96283 and 70 more.