PT-2026-42670 · Nimiq+1 · Core-Rs-Albatross+1

Published 2026-05-21 · Updated 2026-06-10 · CVE-2026-46542

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Nimiq versions prior to 1.4.0

Description A denial-of-service issue exists in the Ed25519 multisig delinearization code path. The function Ed25519PublicKey::delinearize() in keys/src/multisig/mod.rs uses .unwrap() during curve point decompression, causing a panic when a public key is constructed from 32 bytes that do not represent a valid point on the Ed25519 curve. Because Ed25519PublicKey construction only validates byte length and not curve membership, invalid keys can crash the hosting process. A secondary panic occurs in Commitment::From<[u8; 32]> due to similar failing curve point decompression. This affects browser and desktop wallet users of the web-client WASM library and the nimiq-wallet crate when initiating a multisig operation with an attacker-supplied public key.

Recommendations Update to version 1.4.0. Only perform multisig operations with public keys received from trusted sources.

Fix

DoS

Assertion Failure

Weakness Enumeration

CWE-617

Related Identifiers

CVE-2026-46542

GHSA-H9CC-W26M-J342

Affected Products

Core-Rs-Albatross

Nimiq-Keys

References · 8

• https://osv.dev/vulnerability/GHSA-h9cc-w26m-j342 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-46542 · Security Note
• https://github.com/nimiq/core-rs-albatross · Note
• https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-h9cc-w26m-j342 · Note
• https://github.com/nimiq/core-rs-albatross/pull/3713 · Note
• https://github.com/nimiq/core-rs-albatross/releases/tag/v1.4.0 · Note
• https://github.com/nimiq/core-rs-albatross/commit/3bc449a8138960c4de6bfd506bad1730c621d4de · Note
• https://t.me/CVEtracker/56387 · Telegram Post