CVE-2026-54578 mport verify can compare stale checksum data after hashing failures
Attackers can bypass package integrity checks by causing hashing failures, allowing malicious packages to appear valid in MidnightBSD.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-54578?
CVE-2026-54578 is a low-severity vulnerability in MidnightBSD mport, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
mport is the MidnightBSD Package Manager. Prior to 2.7.8, mport_verify_package() in libmport/verify.c could continue after MD5File() or SHA256_File() failed and compare an expected checksum with stale data in the hash buffer rather than a newly computed digest. An attacker able to influence an installed file or the conditions that make hashing fail could receive a misleading integrity result or hide a checksum failure. This issue is fixed in version 2.7.8.
Which versions are affected by CVE-2026-54578?
How do I fix CVE-2026-54578?
No fix has been published for CVE-2026-54578 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-54578 being exploited?
There is no known exploitation of CVE-2026-54578 in the wild and no public exploit code.
Sources
Also known as GHSA-hgmr-9p75-q5cg.