What’s Vulnerable › Vulnerabilities
CVE-2026-54579: mport mirror-selection ping accepts insufficiently validated ICMP replies
- Severity: low (CVSS 2.3 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-17 · updated 2026-09-24
- Weakness: CWE-125
Description
mport is the MidnightBSD Package Manager. Prior to 2.7.8, ping() in libmport/ping.c accepted ICMP replies without validating icmp_id or icmp_seq and parsed the reply using a fixed IP-header offset instead of ip_hl. A network attacker able to inject or spoof visible ICMP replies could influence mirror latency selection, while a malformed packet carrying IP options could shift the ICMP header and trigger an out-of-bounds read. This issue is fixed in version 2.7.8.
Affected products
- MidnightBSD mport: before 2.7.8
References
Get alerted when CVE-2026-54579 or the next vulnerability affects your stack