{"id":"CVE-2026-46542","aliases":["GHSA-h9cc-w26m-j342"],"url":"https://o3.security/vulnerability/CVE-2026-46542","summary":"nimiq-keys: Denial of service in Ed25519 multisig delinearization via invalid curve points","details":"### Impact\n\nA denial-of-service vulnerability exists in the Ed25519 multisig delinearization code path. `Ed25519PublicKey::delinearize()` in `keys/src/multisig/mod.rs` called `.unwrap()` on curve point decompression, which panics when a public key is\nconstructed from 32 bytes that do not represent a valid point on the Ed25519 curve. `Ed25519PublicKey` construction only validates byte length, not curve membership, so invalid keys can reach the delinearization path and crash the\nhosting process.\n\nA secondary panic existed in `Commitment::From<[u8; 32]>`, which similarly called `.unwrap()` on a failing curve point decompression.\n\n**Who is affected:** Browser and desktop wallet users of the web-client WASM library and the `nimiq-wallet` crate, when initiating a multisig operation with an attacker-supplied public key. An attacker must convince the user to include\na crafted public key in a multisig setup — this is not a remotely triggerable node/validator crash.\n\n**Who is NOT affected:** Validator nodes, consensus, blockchain, mempool, and networking code. There is no on-chain multisig account type; multisig is a purely client-side construct, and no validator/consensus code calls the multisig  delinearization path.\n\n### Patches\n\nSee [PR](https://github.com/nimiq/core-rs-albatross/pull/3713).\n\n### Workarounds\n\nNo code-level workaround exists short of the patch. Users of wallet applications can mitigate exposure by only performing multisig operations with public keys received from trusted sources.\n\n### Resources\n- Affected code: `keys/src/multisig/mod.rs`, `keys/src/multisig/commitment.rs`","published":"2026-06-09T23:46:21.832Z","modified":"2026-08-12T03:51:12.996949284Z","cvss":{"score":4.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"},"epss":{"score":0.00231,"percentile":0.14124,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"nimiq-keys","fixedVersion":"1.4.0"}],"fix":{"url":"https://github.com/nimiq/core-rs-albatross/pull/3713","label":"nimiq/core-rs-albatross#3713"},"references":[{"type":"WEB","url":"https://github.com/nimiq/core-rs-albatross/releases/tag/v1.4.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46542.json"},{"type":"ADVISORY","url":"https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-h9cc-w26m-j342"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46542"},{"type":"FIX","url":"https://github.com/nimiq/core-rs-albatross/pull/3713"},{"type":"WEB","url":"https://github.com/nimiq/core-rs-albatross/commit/3bc449a8138960c4de6bfd506bad1730c621d4de"},{"type":"PACKAGE","url":"https://github.com/nimiq/core-rs-albatross"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:12.996949284Z"}}