MidnightBSD mport up to 2.7.7 ICMP Reply Processing libmport/ping.c ping out-of-bounds

Summaryinfo

A vulnerability identified as very critical has been detected in MidnightBSD mport up to 2.7.7. This issue affects the function ping of the file libmport/ping.c of the component ICMP Reply Processing. This manipulation causes out-of-bounds. This vulnerability is tracked as CVE-2026-54579. The attack is possible to be carried out remotely. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability has been found in MidnightBSD mport up to 2.7.7 and classified as very critical. Affected by this vulnerability is the function ping of the file libmport/ping.c of the component ICMP Reply Processing. The manipulation with an unknown input leads to a out-of-bounds vulnerability. The CWE definition for the vulnerability is CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

mport is the MidnightBSD Package Manager. Prior to 2.7.8, ping() in libmport/ping.c accepted ICMP replies without validating icmp_id or icmp_seq and parsed the reply using a fixed IP-header offset instead of ip_hl. A network attacker able to inject or spoof visible ICMP replies could influence mirror latency selection, while a malformed packet carrying IP options could shift the ICMP header and trigger an out-of-bounds read. This issue is fixed in version 2.7.8.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-54579 since 06/15/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/17/2026).

Upgrading to version 2.7.8 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• MidnightBSD

Name

• mport

Version

• 2.7.0
• 2.7.1
• 2.7.2
• 2.7.3
• 2.7.4
• 2.7.5
• 2.7.6
• 2.7.7

Website

• Product: https://github.com/MidnightBSD/mport/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion