VU#701544: mpc-lib Hardened Derivation Fails to Protect Ancestor Isolation

2026-10-27T08:52:01Z•d6192368519e29cbfbc3e265547bdeb74dc7b8f92deb651f1aecc767336c95a4
CVE-2026-100156CVE-2026-109618CVE-2026-109619CVE-2026-34073CVE-2026-3547CVE-2026-3833CVE-2026-90975CVE-2026-91141CVE-2026-96679CVE-2026-96681CVE-2026-97406BIP32BishengCVE-2026MPCPHPTLSX.509Xerjauthentication-bypassauthorization-bypasscommand-injectioncryptographic-failuredenial-of-servicememory-corruptionmultiple-vulnerabilitiesremote-code-executionvsomeip

What happened

CERT/CC vulnerability notes covering multiple products and vulnerability classes, including cryptographic ancestor-isolation failure in Fireblocks mpc-lib, unauthenticated memory exhaustion in COVESA vsomeip, remote code execution issues in PHP, authentication and token-minting bypasses in Xerj and Bisheng, X.509 Name Constraints enforcement inconsistencies across TLS libraries, and OS command injection in Komodo Periphery. Several issues have associated 2026 CVEs and require urgent patching where affected deployments are exposed.

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence and limitations

Source ID
certcc_vulnotes
Record identifier
d6192368519e29cbfbc3e265547bdeb74dc7b8f92deb651f1aecc767336c95a4
Enrichment time
2026-10-27T08:52:01Z
AI-assisted enrichment
Yes

This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.

Record · VU#701544: mpc-lib Hardened Derivation Fails to Protect Ancestor Isolation · Baitaphish