PT-2025-48044 · Cggmp24 · Cggmp24

Published 2025-11-24 · Updated 2025-12-01 · CVE-2025-66016

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions CGGMP24 versions prior to 0.6.3 CGGMP24 version 0.6.3 CGGMP24 versions 0.6.3 through 0.7.0-alpha.2

Description A missing check in the ZK proof allows a single malicious signer to reconstruct the full private key. The issue was addressed with a fix in version 0.6.3. Upgrading to version 0.7.0-alpha.2 is recommended as it includes additional security checks.

Recommendations Versions prior to 0.6.3 should be upgraded to version 0.6.3 or later. Version 0.6.3 should be upgraded to version 0.7.0-alpha.2 for enhanced security.

Exploit

Fix

Insufficient Verification of Data Authenticity

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-345

CWE-347

Related Identifiers

CVE-2025-66016

GHSA-M95P-425X-X889

RUSTSEC-2025-0129

RUSTSEC-2025-0130

Affected Products

Cggmp24

References · 22

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66016.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-66016 · Security Note
• https://osv.dev/vulnerability/RUSTSEC-2025-0130 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m95p-425x-x889 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2025-0129 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-66016 · Vendor Advisory
• https://github.com/LFDT-Lockness/cggmp21/security/advisories/GHSA-m95p-425x-x889 · Note
• https://github.com/LFDT-Lockness/cggmp21 · Note
• https://github.com/LFDT-Lockness/cggmp21/commit/60e0ada5291e771d5649793329d99edd32285e72 · Note
• https://t.me/CVEtracker/38222 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1pbe9h1/resumen_diario_de_vulnerabilidades_01122025 · Reddit Post
• https://crates.io/crates/cggmp21 · Note
• https://rustsec.org/advisories/RUSTSEC-2025-0129.html · Note
• https://reddit.com/r/VulnMatter/comments/1p9dokj/resumen_diario_de_vulnerabilidades_29112025 · Reddit Post
• https://twitter.com/0dayPublishing/status/1993408106936586280 · Twitter Post