VU#701544: Retraction of mpc-lib hardened derivation fails to protect ancestor isolation

2026-10-28T20:52:01Z•88ff15685c22c38f430b92a2e74fddb55c6fe86c922cccd0fab61973410c4f22
CVE-2026-100156CVE-2026-109618CVE-2026-109619CVE-2026-34073CVE-2026-3547CVE-2026-3833CVE-2026-91141CVE-2026-96679CVE-2026-96681CVE-2026-97406BishengBoringSSLCERT/CCLLM-platformPHPTLSX.509Xerjaccount-takeoverauthentication-bypassauthorization-bypassautomotivecredential-mintingcryptographydenial-of-servicememory-corruptionmemory-exhaustionname-constraintsremote-code-executionretracted-findinguse-after-freevsomeipvulnerability

What happened

CERT/CC vulnerability notes cover multiple products and issue types, including PHP remote memory corruption enabling unauthenticated code execution, Bisheng pre-authentication takeover and authorization flaws, Xerj credential-minting authentication bypass, vsomeip TCP memory exhaustion, TLS/X.509 Name Constraints bypasses, and a retracted Fireblocks mpc-lib hardened derivation finding. The collection includes both accepted and disputed or rejected reports; the highest-risk items are the unauthenticated remote code execution and administrative takeover vulnerabilities.

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence and limitations

Source ID
certcc_vulnotes
Record identifier
88ff15685c22c38f430b92a2e74fddb55c6fe86c922cccd0fab61973410c4f22
Enrichment time
2026-10-28T20:52:01Z
AI-assisted enrichment
Yes

This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.