CVE-2026-55174

EUVD-2026-90188
UltrafastSecp256k1 is a high-performance, multi-backend secp256k1 engine with reproducible audit evidence, compatibility shims, and profile-based review scopes. Prior to version 4.2.0, UltrafastSecp256k1's ECDSA adaptor pre-signature verification accepts forged adaptor pre-signatures whose "r" value is not cryptographically bound to the adaptor point "T". This issue has been patched in version 4.2.0.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.9 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/shrec/UltrafastSecp256k1/commit/5478ef566c6af91b48a45c0c61f161f5b1071981
https://github.com/shrec/UltrafastSecp256k1/releases/tag/v4.2.0
https://github.com/shrec/UltrafastSecp256k1/releases/tag/v4.2.1
https://github.com/shrec/UltrafastSecp256k1/security/advisories/GHSA-c7q2-gv3g-rgxm
https://github.com/shrec/UltrafastSecp256k1/security/advisories/GHSA-c7q2-gv3g-rgxm