# CVE-2026-54580: MidnightBSD mport zstd decompression error handling failure

Source: https://junglewise.ai/threats/cve-2026-54580-midnightbsd-mport-zstd-decompression-error-handling-failure  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-17. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-54580 · Severity: info · Published 2026-09-17

mport is the package manager for MidnightBSD, a BSD-derived operating system. Prior to version 2.7.8, mport failed to properly validate corrupted or truncated package index data downloaded from mirrors. An attacker controlling a mirror could serve malformed compressed indexes that mport would partially accept, leading to corrupted package metadata being used for subsequent operations or service disruption when index verification fails.

Technologies: [MidnightBSD Mport](https://junglewise.ai/threats/technologies/mport). Vendors: [MidnightBSD](https://junglewise.ai/threats/vendors/midnightbsd).

## Quick answers

**Is CVE-2026-54580 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54580 being exploited in the wild.

**How severe is CVE-2026-54580?** Informational severity, published 17 September 2026.

**Which products and versions are affected?** MidnightBSD Mport before 2.7.8.

**Is there a fix for CVE-2026-54580?** A patch was published on 2026-05-15: Fix merged in version 2.7.8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54580 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-54580?** Check whether you run MidnightBSD Mport at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in libmport/util.c's mport_decompress_zstd() and libmport/fetch.c's index-fetch logic, which did not consistently handle failures in ZSTD stream decompression or fwrite output operations as fatal errors. A malicious or faulty mirror could supply truncated or corrupt zstd-compressed package index data; the decompressor would fail to complete the stream or write output, but the partial index data would remain available for later use rather than being immediately rejected. The fix (version 2.7.8) hardens validation by treating all decompression and write failures as fatal, propagating errors to callers, and unlinking incomplete output files to prevent downstream consumption of corrupted metadata. The attack vector requires the attacker to compromise or intercept a package mirror that the target system trusts.

## Affected products

- MidnightBSD mport before 2.7.8

## Timeline

- 2026-09-17: disclosed
- 2026-05-15: patched: Fix merged in version 2.7.8

## References

- [https://github.com/MidnightBSD/mport/commit/b3e11ba078351402082a881209ee6fda5d332e3d](https://github.com/MidnightBSD/mport/commit/b3e11ba078351402082a881209ee6fda5d332e3d)
- [https://github.com/MidnightBSD/mport/pull/135](https://github.com/MidnightBSD/mport/pull/135)

## Related threats

- [mport insecure TMPDIR usage in privileged contexts](https://junglewise.ai/threats/cve-2026-54584-mport-is-the-midnightbsd-package-manager-mport-before-2-7-8-used)
- [MidnightBSD mport directory traversal in package installation](https://junglewise.ai/threats/cve-2026-54587-midnightbsd-mport-directory-traversal-in-package-installation)
- [MidnightBSD mport HTTP package fetch without HTTPS enforcement](https://junglewise.ai/threats/cve-2026-54586-midnightbsd-mport-http-package-fetch-without-https-enforcement)
- [MidnightBSD mport path traversal in sample-file handling](https://junglewise.ai/threats/cve-2026-54585-midnightbsd-mport-path-traversal-in-sample-file-handling)
- [MidnightBSD mport path traversal in bundle filename handling](https://junglewise.ai/threats/cve-2026-54583-midnightbsd-mport-path-traversal-in-bundle-filename-handling)