CVE-2026-54579: midnightbsd mport Out-of-bounds Read

Vulnerability summary

CVE-2026-54579 is a low (CVSS 2.3) Out-of-bounds Read vulnerability in midnightbsd mport. EPSS estimates a 0.16% chance of exploitation in the next 30 days, higher than 4.6% of scored vulnerabilities.

Timeline

1. 17-09-2026
   PublishedVulnerability first disclosed.
2. 24-09-2026
   Last modifiedVulnerability information updated.

Description

mport is the MidnightBSD Package Manager. Prior to 2.7.8, ping() in libmport/ping.c accepted ICMP replies without validating icmp_id or icmp_seq and parsed the reply using a fixed IP-header offset instead of ip_hl. A network attacker able to inject or spoof visible ICMP replies could influence mirror latency selection, while a malformed packet carrying IP options could shift the ICMP header and trigger an out-of-bounds read. This issue is fixed in version 2.7.8.

• CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.
• CWE-345Insufficient Verification of Data AuthenticityThe product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.