What is CVE-2026-55174?

CVE-2026-55174 is a medium-severity vulnerability in Shrec Ultrafastsecp256k1, classified under Insufficient Verification of Data Authenticity. CVSS score: 5.9/10. Published 2026-09-30.

How severe is CVE-2026-55174?

Medium severity. CVSS v3 base score is 5.9 out of 10.

Vulnerability in Shrec Ultrafastsecp256k1

CVE-2026-55174

UltrafastSecp256k1 is a high-performance, multi-backend secp256k1 engine with reproducible audit evidence, compatibility shims, and profile-based review scopes. Prior to version 4.2.0, UltrafastSecp256k1's ECDSA adaptor pre-signature verification accepts forged adaptor pre-signatures whose "r" value is not cryptographically bound to the adaptor point "T". This issue has been patched in version 4.2.0.

Published 2026-09-30 · last modified 2026-09-30.

CVSS v3 metric

CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Shrec Ultrafastsecp256k1 — versions < 4.2.0

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-55174?: CVE-2026-55174 is a medium-severity vulnerability in Shrec Ultrafastsecp256k1, classified under Insufficient Verification of Data Authenticity. CVSS score: 5.9/10. Published 2026-09-30.
How severe is CVE-2026-55174?: Medium severity. CVSS v3 base score is 5.9 out of 10.