polytope-labs hyperbridge up to 15.0.0 control flow

Summaryinfo

A vulnerability, which was classified as very critical, has been found in polytope-labs hyperbridge up to 15.0.0. Affected by this vulnerability is an unknown functionality. Performing a manipulation results in control flow. This vulnerability is identified as CVE-2025-24800. The attack can be initiated remotely. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as very critical has been found in polytope-labs hyperbridge up to 15.0.0. This affects an unknown functionality. The manipulation with an unknown input leads to a control flow vulnerability. CWE is classifying the issue as CWE-670. The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Hyperbridge is a hyper-scalable coprocessor for verifiable, cross-chain interoperability. A critical vulnerability was discovered in the ismp-grandpa crate, that allowed a malicious prover easily convince the verifier of the finality of arbitrary headers. This could be used to steal funds or compromise other kinds of cross-chain applications. This vulnerability is fixed in 15.0.1.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2025-24800 since 01/23/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 01/28/2025).

Upgrading to version 15.0.1 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• polytope-labs

Name

• hyperbridge

Version

• 15.0

Website

• Product: https://github.com/polytope-labs/hyperbridge/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion