Net::BitTorrent EUVD-2026-40291

MSE must be enabled and actively used - it is the default encrypted connection mode in Net::BitTorrent, so default deployments are affected without any special configuration. The attacker must be passively positioned on the network path between the two peers to observe a complete MSE DH handshake, including both the DH public key and the immediately following cleartext random padding bytes from _random_pad in the same rand() sequence. No authentication, credentials, or active injection into the stream is required. Exploitation is strictly read-only - the flaw enables passive decryption but not stream manipulation. The attack does not apply if MSE is explicitly disabled (plaintext mode), since no RC4 encryption is then in use. The vulnerability does not affect confidentiality of content that was already transmitted in plaintext outside of MSE.

The CVSS 3.1 score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) accurately characterizes the attack as network-accessible but high-complexity, since successful exploitation requires a network-positioned passive observer who can capture a complete MSE handshake. Real-world risk is moderate: the math of the attack is entirely deterministic - private key recovery is not probabilistic but guaranteed once padding bytes are observed - yet operational preconditions (ISP-level or LAN-level vantage point) limit opportunistic mass exploitation. It is important to note that MSE was never designed as strong encryption, only as traffic obfuscation to avoid ISP throttling; however, this flaw allows an adversary to break even that limited privacy guarantee. No EPSS score was provided in the intelligence data. No CISA KEV listing exists, and no confirmed public exploit code was identified, suggesting exploitation remains theoretically straightforward but not yet commodity. CVSS signals and the vulnerability description are consistent - no conflicts to flag.

An ISP-level passive observer or local network attacker captures the complete MSE DH handshake between a Net::BitTorrent ≤ 2.0.1 client and a remote peer, extracting the cleartext random padding bytes emitted by _random_pad. The observer feeds these bytes into a drand48 state-recovery tool, reconstructs the internal PRNG state, rewinds to derive the 160-bit DH private key, and computes the shared secret using the peer's public DH key already visible on the wire; the observer then derives the RC4 keystream and decrypts the full MSE-encrypted session. No active participation in the handshake is required.