Diem CMS CVE-2026-112041

Exploitation requires that dmString::random output be used in a security-sensitive context (e.g., session tokens, password-reset tokens, CSRF nonces, or unique identifiers) AND that the attacker can observe enough generated values to infer the PRNG state. Limiting factors: the CVSS AC:H rating and the vendor's statement that exploitability is 'difficult' indicate significant practical hurdles; impact is confined to low confidentiality (predictable values) with no integrity or availability effect. Because Diem uses a rolling release, no fixed version exists to validate against, and there is no evidence the weak randomness is used in a high-value flow by default.

This is a low-priority issue despite being remotely reachable. The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N) scores only 2.9, driven by high attack complexity (AC:H) and a single low-confidentiality impact (VC:L) with no integrity or availability effect. The CWE-338 weakness means dmString::random relies on a cryptographically weak PRNG, so the realistic payoff is predicting or recovering 'random' values (e.g., tokens, identifiers) rather than direct code execution or data compromise. Signals are consistent and modest: publicly available exploit code exists (CVLDB-referenced GitHub issue), but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation - the E:P (Proof-of-Concept) threat metric in the input aligns with 'POC exists, not weaponized.' The vendor's own framing ('exploitability is difficult,' 'high complexity') matches the AC:H rating. Net assessment: a genuine but minor cryptographic weakness in an obscure product; not an urgent patch priority. Note: no EPSS value was supplied in the input, so probabilistic exploitation likelihood could not be cross-checked.

A remote attacker who can observe multiple values produced by dmString::random (such as session identifiers, reset tokens, or nonces) collects samples and uses the known weak PRNG algorithm to reconstruct its internal state and predict future outputs. A proof-of-concept is publicly available via the project's GitHub issue tracker, but the attack is rated high-complexity and requires favorable conditions to be practical.