CVE-2025-54426
Last modified
CVE-2025-54426 is a critical-severity vulnerability rated 9.9/10 on the CVSS scale. Polkadot Frontier is an Ethereum and EVM compatibility layer for Polkadot and Substrate. In versions prior to commit 36f70d1, the Curve25519Add and Curve25519ScalarMul precompiles incorrectly handle invalid Ristretto point representations. EPSS estimates a 0.31% chance of exploitation in the next 30 days.
Description
Polkadot Frontier is an Ethereum and EVM compatibility layer for Polkadot and Substrate. In versions prior to commit 36f70d1, the Curve25519Add and Curve25519ScalarMul precompiles incorrectly handle invalid Ristretto point representations. Instead of returning an error, they silently treat invalid input bytes as the Ristretto identity element, leading to potentially incorrect cryptographic results. This is fixed in commit 36f70d1.
Metrics
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-54426?
How severe is CVE-2025-54426?
How do I fix CVE-2025-54426?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-54420Rejected reason: This CVE is a duplicate of CVE-2025-8129.
- CVE-2025-54421NamelessMC is a free, easy to use & powerful website softwar…5.4
- CVE-2025-54422Sandboxie is a sandbox-based isolation software for 32-bit a…5.5
- CVE-2025-54423copyparty is a portable file server. In versions up to and i…6.1
- CVE-2025-544241Panel is a web interface and MCP Server that manages websit…9.8
- CVE-2025-54425Umbraco is an ASP.NET CMS. In versions 13.0.0 through 13.9.2…5.3
- CVE-2025-54427Polkadot Frontier is an Ethereum and EVM compatibility layer…6.9
- CVE-2025-54428RevelaCode is an AI-powered faith-tech project that decodes …9.8
- CVE-2025-54429Polkadot Frontier is an Ethereum and EVM compatibility layer…6.9
- CVE-2025-5443A vulnerability, which was classified as critical, was found…9.8
- CVE-2025-54430dedupe is a python library that uses machine learning to per…9.1
- CVE-2025-54432Rejected reason: This CVE is a duplicate of another CVE. See…
Are you affected by CVE-2025-54426?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST