VU#701544: mpc-lib Hardened Derivation Fails to Protect Ancestor Isolation
Overview Fireblocks' mpc-lib library contains a cryptographic fail-open vulnerability in its BIP32 hardened derivation implementation in the case of a missing private parent key. This breaks the ancestor isolation property of hardened derivation, allowing an attacker with a compromised lower-level signer share to recover the higher-level share it was derived from. Description Fireblocks is a digital-asset custody…
Excerpt from the primary source: CERT/CC Vulnerability Notes
Who is affected
Developers
What you should do · Review
Review whether your organization uses the affected products and assess exposure using the linked advisories.
Automated guidance based on this story's classification. Check the linked advisories for specifics.
Sources
We link to original and authoritative sources. Headlines and excerpts belong to their publishers.
Government advisory
Related
Apple Patches for October 2026, (Mon, Oct 26th)
Apple today released patches for 304 vulnerabilties. This number is still in line with prior Apple updates, and comes just about a month after the last apple update.
VU#128947: COVESA vsomeip excessive memory allocation in reliable (TCP) endpoint buffer handling
Overview vsomeip, COVESA's open source implementation of the SOME/IP automotive communication middleware, contained a memory allocation vulnerability present in versions 3.7.3 and below. A vsomeip reliable (TCP) SOME/IP endpoint grows its receive buffer to an attacker-declared message size before validating that the declared bytes have actually been received, allowing a remote, unauthenticated peer to exhaust host…
Critical 'HTTP2Shell' Brotli vulnerability triggers emergency patches
A critical flaw dubbed 'HTTP2Shell' in Brotli, the C decoder library built into Node.js, could allow attackers to corrupt memory and access sensitive data.
Apply the vendor's security update for the affected products.
Microsoft releases emergency .NET patches for critical Brotli flaw
Microsoft released emergency .NET security updates to patch a critical vulnerability known as Broccoli2Shell, also tracked as Node2Shell and HTTP2Shell.
Apply the vendor's security update for the affected products.