Nimiq: Out-of-bounds panic in KeyNibbles::Add from oversized child suffix in a deserialized proof

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-54542 · Microsoft / collected KEV context

EUVD-2026-77574

GHSA-5rg2-xv9j-gv5p

cve-program · CVE-2026-54542

• https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-5rg2-xv9j-gv5p
• https://github.com/nimiq/core-rs-albatross/pull/3790
• https://github.com/nimiq/core-rs-albatross/commit/eabfc3e21731b0628c3f933163a0f1e1864217bf
• https://github.com/nimiq/core-rs-albatross/releases/tag/v1.6.0

euvd · EUVD-2026-77574

• https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-5rg2-xv9j-gv5p
• https://github.com/nimiq/core-rs-albatross/pull/3790
• https://github.com/nimiq/core-rs-albatross/commit/eabfc3e21731b0628c3f933163a0f1e1864217bf
• https://github.com/nimiq/core-rs-albatross/releases/tag/v1.6.0

nvd · CVE-2026-54542

• https://github.com/nimiq/core-rs-albatross/commit/eabfc3e21731b0628c3f933163a0f1e1864217bf
• https://github.com/nimiq/core-rs-albatross/pull/3790
• https://github.com/nimiq/core-rs-albatross/releases/tag/v1.6.0
• https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-5rg2-xv9j-gv5p

osv · GHSA-5rg2-xv9j-gv5p

• https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-5rg2-xv9j-gv5p
• https://github.com/nimiq/core-rs-albatross/pull/3790
• https://github.com/nimiq/core-rs-albatross/commit/eabfc3e21731b0628c3f933163a0f1e1864217bf
• https://github.com/nimiq/core-rs-albatross
• https://github.com/nimiq/core-rs-albatross/releases/tag/v1.6.0

No related operational record is retained in the current change model.