CVE-2026-54578

Name of the Vulnerable Software and Affected Versions mport versions prior to 2.7.8

Description The mport verify package() function in libmport/verify.c may continue execution after MD5File() or SHA256 File() fails. This allows the system to compare an expected checksum against stale data remaining in the hash buffer instead of a newly computed digest. An attacker who can influence an installed file or the conditions causing the hashing process to fail could hide a checksum failure or obtain a misleading integrity result.

Recommendations Update to version 2.7.8.