CVE-2026-54579

Name of the Vulnerable Software and Affected Versions mport versions prior to 2.7.8

Description The ping() function in libmport/ping.c fails to validate icmp id or icmp seq when accepting ICMP replies and uses a fixed IP-header offset instead of ip hl for parsing. A network attacker capable of injecting or spoofing ICMP replies can influence the selection of mirror latency. Additionally, a malformed packet containing IP options can shift the ICMP header, leading to an out-of-bounds read, which occurs when a program reads data outside the intended boundary of a buffer.

Recommendations Update to version 2.7.8.