CVE-2026-54578NVD

Description

mport is the MidnightBSD Package Manager. Prior to 2.7.8, mport_verify_package() in libmport/verify.c could continue after MD5File() or SHA256_File() failed and compare an expected checksum with stale data in the hash buffer rather than a newly computed digest. An attacker able to influence an installed file or the conditions that make hashing fail could receive a misleading integrity result or hide a checksum failure. This issue is fixed in version 2.7.8.

Severity Level

UNKNOWN

Published Date

17/09/2026

Last Modified

18/09/2026

Exploitation Status

????

EPSS Score

0.11% (percentile 1.3%)

CVSS Base Metrics

CVSS v4 (4.0)

LOW 2

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Weaknesses (CWE)

CWE-354 - CWE-354: Improper Validation of Integrity Check ValueCWE-755 - CWE-755: Improper Handling of Exceptional Conditions

Affected & Patched Versions

Product	Affected Versions	Patched Version
MidnightBSD mport	< 2.7.8	N/A

📧Email Delivery — Threat intel straight to your inbox.

♾️Unlimited Vendors — Track your entire stack.

🚨All New CVEs — Be the first to know.

⚙️Custom EPSS — Filter noise, focus on risk.

💬Webhooks — Slack & Teams integration.

🚫Ad-Free — Uninterrupted experience.