VU#701544: Retraction of mpc-lib hardened derivation fails to protect ancestor isolation
2026-10-28T20:52:01Z•88ff15685c22c38f430b92a2e74fddb55c6fe86c922cccd0fab61973410c4f22
CVE-2026-100156CVE-2026-109618CVE-2026-109619CVE-2026-34073CVE-2026-3547CVE-2026-3833CVE-2026-91141CVE-2026-96679CVE-2026-96681CVE-2026-97406BishengBoringSSLCERT/CCLLM-platformPHPTLSX.509Xerjaccount-takeoverauthentication-bypassauthorization-bypassautomotivecredential-mintingcryptographydenial-of-servicememory-corruptionmemory-exhaustionname-constraintsremote-code-executionretracted-findinguse-after-freevsomeipvulnerability
What happened
CERT/CC vulnerability notes cover multiple products and issue types, including PHP remote memory corruption enabling unauthenticated code execution, Bisheng pre-authentication takeover and authorization flaws, Xerj credential-minting authentication bypass, vsomeip TCP memory exhaustion, TLS/X.509 Name Constraints bypasses, and a retracted Fireblocks mpc-lib hardened derivation finding. The collection includes both accepted and disputed or rejected reports; the highest-risk items are the unauthenticated remote code execution and administrative takeover vulnerabilities.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- certcc_vulnotes
- Record identifier
- 88ff15685c22c38f430b92a2e74fddb55c6fe86c922cccd0fab61973410c4f22
- Enrichment time
- 2026-10-28T20:52:01Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.