EUVD-2026-82330Severity by source
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent network positioning (AV:A) plus the need to spoof visible ICMP replies during a probing race maps to AC:H; effects are low-integrity mirror tampering and low-availability crash, with no confidentiality leak (C:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
mport is the MidnightBSD Package Manager. Prior to 2.7.8, ping() in libmport/ping.c accepted ICMP replies without validating icmp_id or icmp_seq and parsed the reply using a fixed IP-header offset instead of ip_hl. A network attacker able to inject or spoof visible ICMP replies could influence mirror latency selection, while a malformed packet carrying IP options could shift the ICMP header and trigger an out-of-bounds read. This issue is fixed in version 2.7.8.
AnalysisAI
Spoofed or injected ICMP echo replies can steer mport's mirror-latency selection toward an attacker-chosen mirror and, if the reply carries IP options, shift the parsed ICMP header past the hardcoded offset used by ping() in libmport/ping.c, causing an out-of-bounds read. The flaw affects MidnightBSD mport releases prior to 2.7.8 and is only reachable by an unauthenticated attacker on the same adjacent network segment who can place visible ICMP traffic on-path while an mport client is actively probing mirrors (assessed CVSS:3.1 AV:A/AC:H/PR:N/UI:N/C:N/I:L/A:L; CVSS 4.0 base 2.3). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the attacker to be on the same adjacent network segment (AV:A) as an mport client and able to inject or spoof ICMP echo replies that reach the victim while mport is actively performing its ICMP-based mirror-latency probing (the ping()/mirror-selection code path in libmport/ping.c). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a low-priority, low-real-risk issue despite being a memory-safety flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade mport to version 2.7.8, which is the vendor-released fix for this issue, and re-run any mirror-selection or package operations afterward; the advisory at https://github.com/MidnightBSD/mport/security/advisories/GHSA-qc2f-2j7j-m3r7 should be consulted for the exact package or source update procedure. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Midnightbsd
View allA memory corruption vulnerability was found in the kernel function kern_getfsstat in MidnightBSD before 1.2.7 and 1.3 th
Package-index corruption and denial of package-management operations affect MidnightBSD mport before 2.7.8 when a malici
Path traversal in the MidnightBSD mport package manager (libmport/fetch.c) before version 2.7.8 lets an attacker who con
MidnightBSD's mport package manager prior to 2.7.8 can accept a tampered bootstrap package index as verified, because th
On-path tampering with package-fetch traffic in MidnightBSD's mport package manager lets a network-positioned attacker s
Path traversal in MidnightBSD mport before 2.7.8 allows a crafted package manifest to make the privileged sample-file ha
Package file overwrite in MidnightBSD mport prior to 2.7.8 allows a crafted package installed with privileges to replace
Filesystem integrity compromise in MidnightBSD's mport package manager (versions prior to 2.7.8): a local user who alrea
Symlink following and dot-dot path traversal in MidnightBSD mport prior to 2.7.8 lets a local attacker who can already w
Path-racing and shell-invocation weaknesses in the MidnightBSD mport package manager (all versions prior to 2.7.8) let a
In MidnightBSD before 1.2.6 and 1.3 before August 2020, and FreeBSD before 7, a NULL pointer dereference was found in th
Checksum verification in MidnightBSD's mport package manager before 2.7.8 can silently continue after a hashing failure,
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today