CVE-2026-90975

Name of the Vulnerable Software and Affected Versions mpc-lib (affected versions not specified)

Description A cryptographic implementation flaw in the mpc-lib library used in the MPC-based custody pipeline breaks the security guarantee of BIP32 hardened derivation. The issue occurs because the implementation fails to validate the presence of a private parent key before computing the derivation delta. When the parent secret is missing, the system substitutes a null buffer of zeros instead of rejecting the operation. This behavior breaks ancestor isolation, allowing an attacker who has compromised a child signer share and its chain code to mathematically reverse the derivation and recover the higher-level parent share. While this allows for the recovery of ancestor shares, MPC threshold protection still prevents the independent recovery of a full spendable key.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Monitor for anomalous derivation requests that succeed without a valid parent key context and audit logs for derivation operations where the parent key material is absent or zeroed.