CVE-2025-69277
December 31, 2025
libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.
Affected Packages
hdwallet (PYTHON):
Affected version(s) >=0.1.0a1 <3.6.1Fix Suggestion:
Update to version 3.6.1pynacl (PYTHON):
Affected version(s) >=0.1.0 <1.6.2Fix Suggestion:
Update to version 1.6.2Related Resources (15)
Do you need more information?
Contact UsCVSS v4
Base Score:
2.1
Attack Vector
LOCAL
Attack Complexity
HIGH
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
LOW
Vulnerable System Integrity
LOW
Vulnerable System Availability
NONE
Subsequent System Confidentiality
LOW
Subsequent System Integrity
LOW
Subsequent System Availability
NONE
CVSS v3
Base Score:
4.5
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE
Weakness Type (CWE)
Incomplete List of Disallowed Inputs
EPSS
Base Score:
0.02
