# CVE-2026-54579: MidnightBSD mport insufficient ICMP reply validation

Source: https://junglewise.ai/threats/cve-2026-54579-midnightbsd-mport-insufficient-icmp-reply-validation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-17. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-54579 · Severity: info · CVSS 5.9 · Published 2026-09-17

mport is the package manager for MidnightBSD, a FreeBSD derivative, and is used to install and manage software on MidnightBSD systems. A flaw in its mirror-selection logic accepts spoofed ICMP replies without proper validation, allowing an attacker to influence which software repository the system trusts, or potentially crash the mirror-selection process with malformed packets.

Technologies: [MidnightBSD Mport](https://junglewise.ai/threats/technologies/mport). Vendors: [MidnightBSD](https://junglewise.ai/threats/vendors/midnightbsd).

## Quick answers

**Is CVE-2026-54579 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54579 being exploited in the wild.

**How severe is CVE-2026-54579?** Informational severity, with a CVSS score of 5.9, published 17 September 2026.

**Which products and versions are affected?** MidnightBSD Mport before 2.7.8.

**Is there a fix for CVE-2026-54579?** A patch was published on 2026-06-06: version 2.7.8 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54579 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-54579?** Check whether you run MidnightBSD Mport at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The ping() function in libmport/ping.c prior to version 2.7.8 fails to validate the icmp_id and icmp_seq fields of incoming ICMP replies and incorrectly parses the ICMP header using a fixed IP header offset instead of respecting the actual IP header length (ip_hl). This results in two vulnerability classes: CWE-345 (insufficient verification of data authenticity) and CWE-125 (out-of-bounds read). An attacker on the network with the ability to inject or spoof visible ICMP replies can influence mirror latency selection, causing mport to favor an attacker-controlled mirror. Additionally, malformed ICMP packets carrying IP options can shift the ICMP header location and trigger out-of-bounds memory reads. The fix is available in version 2.7.8, which validates both icmp_id and icmp_seq, uses the correct IP header length, adds timeout handling, and improves resource cleanup.

## Affected products

- MidnightBSD mport before 2.7.8

## Timeline

- 2026-06-06: disclosed
- 2026-06-06: patched: version 2.7.8 released

## References

- [https://github.com/MidnightBSD/mport/security/advisories/GHSA-qc2f-2j7j-m3r7](https://github.com/MidnightBSD/mport/security/advisories/GHSA-qc2f-2j7j-m3r7)

## Related threats

- [mport insecure TMPDIR usage in privileged contexts](https://junglewise.ai/threats/cve-2026-54584-mport-is-the-midnightbsd-package-manager-mport-before-2-7-8-used)
- [MidnightBSD mport directory traversal in package installation](https://junglewise.ai/threats/cve-2026-54587-midnightbsd-mport-directory-traversal-in-package-installation)
- [MidnightBSD mport HTTP package fetch without HTTPS enforcement](https://junglewise.ai/threats/cve-2026-54586-midnightbsd-mport-http-package-fetch-without-https-enforcement)
- [MidnightBSD mport path traversal in sample-file handling](https://junglewise.ai/threats/cve-2026-54585-midnightbsd-mport-path-traversal-in-sample-file-handling)
- [MidnightBSD mport path traversal in bundle filename handling](https://junglewise.ai/threats/cve-2026-54583-midnightbsd-mport-path-traversal-in-bundle-filename-handling)