VU#701544: mpc-lib Hardened Derivation Fails to Protect Ancestor Isolation
2026-10-27T08:52:01Z•d6192368519e29cbfbc3e265547bdeb74dc7b8f92deb651f1aecc767336c95a4
CVE-2026-100156CVE-2026-109618CVE-2026-109619CVE-2026-34073CVE-2026-3547CVE-2026-3833CVE-2026-90975CVE-2026-91141CVE-2026-96679CVE-2026-96681CVE-2026-97406BIP32BishengCVE-2026MPCPHPTLSX.509Xerjauthentication-bypassauthorization-bypasscommand-injectioncryptographic-failuredenial-of-servicememory-corruptionmultiple-vulnerabilitiesremote-code-executionvsomeip
What happened
CERT/CC vulnerability notes covering multiple products and vulnerability classes, including cryptographic ancestor-isolation failure in Fireblocks mpc-lib, unauthenticated memory exhaustion in COVESA vsomeip, remote code execution issues in PHP, authentication and token-minting bypasses in Xerj and Bisheng, X.509 Name Constraints enforcement inconsistencies across TLS libraries, and OS command injection in Komodo Periphery. Several issues have associated 2026 CVEs and require urgent patching where affected deployments are exposed.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- certcc_vulnotes
- Record identifier
- d6192368519e29cbfbc3e265547bdeb74dc7b8f92deb651f1aecc767336c95a4
- Enrichment time
- 2026-10-27T08:52:01Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.