EUVD-2026-82320Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local CLI tool (AV:L) run by an operator (PR:L); only triggers under specific option-before-argument ordering (AC:H); sole impact is a misleading audit result (I:L, C/A:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
mport is the MidnightBSD Package Manager. Prior to 2.7.8, the audit command in mport/mport.c computed option-adjusted local_argv and local_argc values but passed the original argument entry to audit_package(). When an operator or automation used an option such as -r before a package name, stale optind state and the unadjusted argument could cause mport to audit the option token instead of the requested package, producing a false-negative or useless result that could leave a vulnerable package unidentified. The corrected parsing resets optind and optreset before using the adjusted local arguments. This issue is fixed in version 2.7.8.
AnalysisAI
MidnightBSD's mport package manager, in all versions prior to 2.7.8, mis-parses the argument list for its 'audit' subcommand, so when an option such as -r is placed before the package name the tool audits the option token instead of the requested package and returns a false-negative result. The flaw is reachable only by a local user with low privileges who already has the ability to run mport, requires the specific option-before-argument invocation ordering, and is not remotely triggerable - there is no adversary-controlled input path. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Triggered when the operator or automation invokes mport's `audit` command with an option (such as `-r`) placed before the package name on versions prior to 2.7.8; the stale optind/optreset state then causes audit_package() to receive the unadjusted argument (the option token) instead of the requested package. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely low-risk issue and the signals are internally consistent. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to mport 2.7.8, which is the vendor-released patched version containing the corrected argument handling ('optind = 1' plus 'optreset = 1' reset under MidnightBSD and use of the adjusted local_argc/local_argv when calling audit_package()); the fix landed via pull request https://github.com/MidnightBSD/mport/pull/149 and commit b897240dc8181c53fbee231e77f88657c1edb9a0, with the release at https://github.com/MidnightBSD/mport/releases/tag/2.7.8. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Midnightbsd
View allA memory corruption vulnerability was found in the kernel function kern_getfsstat in MidnightBSD before 1.2.7 and 1.3 th
Package-index corruption and denial of package-management operations affect MidnightBSD mport before 2.7.8 when a malici
Path traversal in the MidnightBSD mport package manager (libmport/fetch.c) before version 2.7.8 lets an attacker who con
MidnightBSD's mport package manager prior to 2.7.8 can accept a tampered bootstrap package index as verified, because th
On-path tampering with package-fetch traffic in MidnightBSD's mport package manager lets a network-positioned attacker s
Path traversal in MidnightBSD mport before 2.7.8 allows a crafted package manifest to make the privileged sample-file ha
Package file overwrite in MidnightBSD mport prior to 2.7.8 allows a crafted package installed with privileges to replace
Filesystem integrity compromise in MidnightBSD's mport package manager (versions prior to 2.7.8): a local user who alrea
Symlink following and dot-dot path traversal in MidnightBSD mport prior to 2.7.8 lets a local attacker who can already w
Path-racing and shell-invocation weaknesses in the MidnightBSD mport package manager (all versions prior to 2.7.8) let a
In MidnightBSD before 1.2.6 and 1.3 before August 2020, and FreeBSD before 7, a NULL pointer dereference was found in th
Spoofed or injected ICMP echo replies can steer mport's mirror-latency selection toward an attacker-chosen mirror and, i
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today