Cryptographically Weak PRNG in Diem Project Affecting Versions Up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad

CVE-2026-112041

What is CVE-2026-112041?

A vulnerability exists in the Diem project's implementation of the dmString::random function within the dmCorePlugin module. This issue leads to the generation of cryptographically weak pseudorandom numbers, posing a risk for remote exploitation. Although the complexity of executing such an exploit is relatively high, the existence of public exploits could potentially expose systems to attack. As the Diem project operates on a rolling release model, version information for patches or updates is not systematically shared, which complicates mitigation efforts. The development team has been notified of the vulnerability but has not yet provided a public response or remediation strategy.

References