CVE-2026-54577

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-54577
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54577.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-54577
Aliases
  • GHSA-h3m9-vj4v-c35h
Published
2026-09-17T16:49:48Z
Modified
2026-09-19T08:14:21Z
Severity
  • 2.0 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
mport audit can inspect the wrong package when options are present
Details

mport is the MidnightBSD Package Manager. Prior to 2.7.8, the audit command in mport/mport.c computed option-adjusted local_argv and local_argc values but passed the original argument entry to audit_package(). When an operator or automation used an option such as -r before a package name, stale optind state and the unadjusted argument could cause mport to audit the option token instead of the requested package, producing a false-negative or useless result that could leave a vulnerable package unidentified. The corrected parsing resets optind and optreset before using the adjusted local arguments. This issue is fixed in version 2.7.8.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-20",
        "CWE-693"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54577.json"
}
References

Affected packages

Git / github.com/midnightbsd/mport

Affected ranges

Type
GIT
Repo
https://github.com/midnightbsd/mport
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b897240dc8181c53fbee231e77f88657c1edb9a0
Fixed
899c8fe2d3ceb25d899e70dbd0c7744b7d7a0946
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "2.7.8"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

2.*
2.0
2.0.1
2.0.2
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.2.0
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.2.8
2.2.9
2.2.9.1
2.3.0
2.4.0
2.4.1
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.6.0
2.6.1
2.6.2
2.6.3
2.6.4
2.6.5
2.6.7
2.6.8
2.7.0
2.7.1
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54577.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "178017498694571944386822326438411095953",
            "length":  1656
        },
        "id":  "CVE-2026-54577-79442789",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/midnightbsd/mport/commit/b897240dc8181c53fbee231e77f88657c1edb9a0",
        "target":  {
            "file":  "mport/mport.c",
            "function":  "install"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "33288761886541973022391192950745765947",
                "282376954453363124379336853278728817347",
                "279343377543815083230126767945778870229",
                "123615650064370579342120544194236986353",
                "1320761903502779357335893957688758926",
                "235754011070082115620363591879628777980",
                "76570137142459398281125795495372629227",
                "316995341391586362691939419354026923995",
                "30208968717120251748230134269079118635",
                "219526549921008753873447469753561202395",
                "157590020662107472491143066687952139201",
                "119101225499751275833571023119199497115",
                "52804172843826604115949387545232336353",
                "334783188950910283248600615653374335023",
                "11955978405439942186380848132897544818",
                "160995833418990987982093358972789486527",
                "267557481086351209951060003422440795016",
                "68679967235740964317058194467751202902",
                "50296221048821320730647601691472183005",
                "251387085355852943129718862067831108561",
                "264523957328214824688893431209796427115",
                "243897946141869093254847167117102986084",
                "337105765923822804751940129965009418816",
                "46615585686801704682225998810523684178",
                "218346453250174044965300532861332187423",
                "283246671023995239873194935408670894978",
                "119884423284907136359206452759687755631",
                "97041307398096108978214321448010929126",
                "217754390661791459875039479550749749672",
                "170520596257718430475835293947653223883",
                "55666636558559567003895312541777872372",
                "2539610615721883776576694755890526965",
                "72290843409431673007904795456914903027",
                "630965469388930355038920282101290563",
                "143431770068963449798333184962844370285",
                "292952302218127683418631000815403933127",
                "173325098612421198357828633390393085035",
                "261176656854276609393539471641629132593",
                "179812386382147804670547293766123942721",
                "199631066260776063150384469713635600649",
                "260010682638768202188901476005608698394",
                "7007988238174286235290488744011718939",
                "204826438485149644185345273575867367383",
                "300173003379859879996198553054877501639",
                "260209324771545526938336365716258900601",
                "202882991943324786010392682535984660453",
                "197464520889736307810801046813093648810",
                "191437375740672111087524022399638622671",
                "18780089903643061838583970983938091791",
                "47360781507150070455606663803944712382",
                "80728591971662864447151563433700955428",
                "64054287940969588568502899438217760830",
                "217754390661791459875039479550749749672",
                "170520596257718430475835293947653223883",
                "55666636558559567003895312541777872372",
                "94197995472315759258040097899998187303",
                "92328919709577770806745719371777391984",
                "178513675476856221905629054547946634053",
                "48061888611373582270317502654032986754",
                "332426865251874799560443666366931271674",
                "299430981435016760443022708375357570980",
                "93126884560421578869630854063577691196",
                "168760571825016476273176070840357172379",
                "157092097649851122785981819326493306397",
                "54386890626293255415251236581772983511",
                "96491050197655973708205368725184246469",
                "432073940370047256341429772981634720",
                "92368208418120565188546919971838344390"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-54577-7d370eb1",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/midnightbsd/mport/commit/b897240dc8181c53fbee231e77f88657c1edb9a0",
        "target":  {
            "file":  "mport/mport.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "222924689335595469504483095689129052634",
            "length":  2445
        },
        "id":  "CVE-2026-54577-bf319f1a",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/midnightbsd/mport/commit/b897240dc8181c53fbee231e77f88657c1edb9a0",
        "target":  {
            "file":  "mport/mport.c",
            "function":  "sort_dependencies_topological"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "4671581288642793296863990960190718304",
            "length":  12050
        },
        "id":  "CVE-2026-54577-f8e77f96",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/midnightbsd/mport/commit/b897240dc8181c53fbee231e77f88657c1edb9a0",
        "target":  {
            "file":  "mport/mport.c",
            "function":  "main"
        }
    }
]
vanir_signatures_modified 
"2026-09-19T08:14:21Z"