-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| fastecdsa | pip | < 2.3.2 | 2.3.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the uninitialized 'result' variable in curvemath_mul. The commit diff explicitly adds mpz_inits() to initialize result.x/y, confirming this was the root cause. The PoC demonstrates exploitation through point multiplication triggering uninitialized memory access in mpz_clears. While pointZZ_pMul and pointZZ_pSetToIdentityElement are involved in the execution path, the primary vulnerable function is curvemath_mul where the uninitialized resource originates.