CVE-2026-54578

UNKNOWN 0.0

mport verify can compare stale checksum data after hashing failures

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

mport is the MidnightBSD Package Manager. Prior to 2.7.8, mport_verify_package() in libmport/verify.c could continue after MD5File() or SHA256_File() failed and compare an expected checksum with stale data in the hash buffer rather than a newly computed digest. An attacker able to influence an installed file or the conditions that make hashing fail could receive a misleading integrity result or hide a checksum failure. This issue is fixed in version 2.7.8.

CWE	CWE-354 CWE-755
Vendor	midnightbsd
Product	mport
Published	Sep 17, 2026

Stay Ahead of the Next One

Get instant alerts for midnightbsd mport

Be the first to know when new unknown vulnerabilities affecting midnightbsd mport are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

MidnightBSD / mport

< 2.7.8

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/MidnightBSD/mport/security/advisories/GHSA-hgmr-9p75-q5cg github.com: https://github.com/MidnightBSD/mport/pull/138 github.com: https://github.com/MidnightBSD/mport/commit/cd9991c3cc1f60ecb3f378852ad8b5caa820e990 github.com: https://github.com/MidnightBSD/mport/releases/tag/2.7.8