Every CVE Search/ Get API key

CVE-2025-66017

CGGMP21 presignatures can be used in the way that significantly reduces security

8.2 HighFix available

CGGMP24 is a state-of-art ECDSA TSS protocol that supports 1-round signing (requires 3 preprocessing rounds), identifiable abort, and a key refresh protocol. In versions 0.6.3 and prior of cggmp21 and version 0.7.0-alpha.1 of cggmp24, presignatures can be used in the way that significantly reduces security. cggmp24 version 0.7.0-alpha.2 release contains API changes that make it impossible to use presignatures in contexts in which it reduces security.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

0.22%Up 0.2 points since Nov 26, 2025
90%50%10%1%

What each source reports

CVE List Score used 8.2

CGGMP21 presignatures can be used in the way that significantly reduces security

CGGMP24 is a state-of-art ECDSA TSS protocol that supports 1-round signing (requires 3 preprocessing rounds), identifiable abort, and a key refresh protocol. In versions 0.6.3 and prior of cggmp21 and version 0.7.0-alpha.1 of cggmp24, presignatures can be used in the way that significantly reduces security. cggmp24 version 0.7.0-alpha.2 release contains API changes that make it impossible to use presignatures in contexts in which it reduces security.

Record
CVE-2025-66017
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-327
Updated
2026-11-02
EUVDEUVD-2025-199640 8.2

CGGMP24 is a state-of-art ECDSA TSS protocol that supports 1-round signing (requires 3 preprocessing rounds), identifiable abort, and a key refresh protocol. In versions 0.6.3 and prior of cggmp21 and version 0.7.0-alpha.1 of cggmp24, presignatures can be used in the way that significantly reduces security. cggmp24 version 0.7.0-alpha.2 release contains API changes that make it impossible to use presignatures in contexts in which it reduces security.

Record
EUVD-2025-199640
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-8frv-q972-9rq5 8.2

cggmp24 and cggmp21 are vulnerable to signature forgery through altered presignatures

Impact

This attack is against presignatures used in very specific context:

  • Presignatures + HD wallets derivation: security level reduces to 85 bits
    Previously users could generate a presignature, and then choose a HD derivation path while issuing a partial signature via Presignature::set_derivation_path, which is malleable to attack that reduces target security level. To mitigate, this method has been removed from API.
  • Presignatures + "raw signing" (when signer signs a hash without knowing an original message): results into signature forgery attack
    Previously, users were able to configure Presignature::issue_partial_signature with hashed message without ever providing original mesage. In new API, this method only accepts digests for which original message has been observed.

Patches

cggmp24 v0.7.0-alpha.2 release contains API changes that make it impossible to use presignatures in contexts in which it reduces security. Follow migration guidelines to upgrade.

Workarounds

Users can continue using un-patched versions of library as long as they don't use presignatures in said scenarios where it weakens system security. To be sure, migrate to patched version that excludes presignatures from being used in such scenarios.

References

Read this blog post to learn more.

Record
GHSA-8frv-q972-9rq5
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-327
Updated
2026-11-02
NVD 8.2

CGGMP24 is a state-of-art ECDSA TSS protocol that supports 1-round signing (requires 3 preprocessing rounds), identifiable abort, and a key refresh protocol. In versions 0.6.3 and prior of cggmp21 and version 0.7.0-alpha.1 of cggmp24, presignatures can be used in the way that significantly reduces security. cggmp24 version 0.7.0-alpha.2 release contains API changes that make it impossible to use presignatures in contexts in which it reduces security.

Record
CVE-2025-66017
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-327
Updated
2026-11-02
OSV 8.2

CGGMP21 presignatures can be used in the way that significantly reduces security

CGGMP24 is a state-of-art ECDSA TSS protocol that supports 1-round signing (requires 3 preprocessing rounds), identifiable abort, and a key refresh protocol. In versions 0.6.3 and prior of cggmp21 and version 0.7.0-alpha.1 of cggmp24, presignatures can be used in the way that significantly reduces security. cggmp24 version 0.7.0-alpha.2 release contains API changes that make it impossible to use presignatures in contexts in which it reduces security.

Record
CVE-2025-66017
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-327
Updated
2026-11-02
OSVGHSA-8frv-q972-9rq5 8.2

cggmp24 and cggmp21 are vulnerable to signature forgery through altered presignatures

Impact

This attack is against presignatures used in very specific context:

  • Presignatures + HD wallets derivation: security level reduces to 85 bits
    Previously users could generate a presignature, and then choose a HD derivation path while issuing a partial signature via Presignature::set_derivation_path, which is malleable to attack that reduces target security level. To mitigate, this method has been removed from API.
  • Presignatures + "raw signing" (when signer signs a hash without knowing an original message): results into signature forgery attack
    Previously, users were able to configure Presignature::issue_partial_signature with hashed message without ever providing original mesage. In new API, this method only accepts digests for which original message has been observed.

Patches

cggmp24 v0.7.0-alpha.2 release contains API changes that make it impossible to use presignatures in contexts in which it reduces security. Follow migration guidelines to upgrade.

Workarounds

Users can continue using un-patched versions of library as long as they don't use presignatures in said scenarios where it weakens system security. To be sure, migrate to patched version that excludes presignatures from being used in such scenarios.

References

Read this blog post to learn more.

Record
GHSA-8frv-q972-9rq5
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-327
Updated
2026-11-02
OSVRUSTSEC-2025-0127 No score

CGGMP21 presignatures can be used in the way that significantly reduces security

This attack is against presignatures used in very specific context:

  • Presignatures + HD wallets derivation: security level reduces to 85 bits
    Previously you could generate a presignature, and then choose a HD derivation path while issuing a partial signature via Presignature::set_derivation_path, which is malleable to attack that reduces target security level. To mitigate, this method has been removed from API.
  • Presignatures + "raw signing" (when signer signs a hash without knowing an original message): results into signature forgery attack
    Previously, you could use Presignature::issue_partial_signature with hashed message without ever providing original mesage. In new API, this method only accepts digests for which original message has been observed.

Patches

cggmp24 v0.7.0-alpha.2 release contains API changes that make it impossible to use presignatures in contexts in which it reduces security. Follow the migration guidelines to upgrade.

Workarounds

You can continue using un-patched versions of library as long as you don't use presignatures in said scenarios where it weakens system security. To be sure, migrate to patched version that excludes presignatures from being used in such scenarios.

References

Read our blog post to learn more.

Record
RUSTSEC-2025-0127
Updated
2026-11-02
OSVRUSTSEC-2025-0128 No score

CGGMP21 presignatures can be used in the way that significantly reduces security

This attack is against presignatures used in very specific context:

  • Presignatures + HD wallets derivation: security level reduces to 85 bits
    Previously you could generate a presignature, and then choose a HD derivation path while issuing a partial signature via Presignature::set_derivation_path, which is malleable to attack that reduces target security level. To mitigate, this method has been removed from API.
  • Presignatures + "raw signing" (when signer signs a hash without knowing an original message): results into signature forgery attack
    Previously, you could use Presignature::issue_partial_signature with hashed message without ever providing original mesage. In new API, this method only accepts digests for which original message has been observed.

Patches

cggmp24 v0.7.0-alpha.2 release contains API changes that make it impossible to use presignatures in contexts in which it reduces security. Follow the migration guidelines to upgrade.

Workarounds

You can continue using un-patched versions of library as long as you don't use presignatures in said scenarios where it weakens system security. To be sure, migrate to patched version that excludes presignatures from being used in such scenarios.

References

Read our blog post to learn more.

Record
RUSTSEC-2025-0128
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
cggmp21
crates.io
 through 0.6.3 None known
cggmp24
crates.io
 before 0.7.0-alpha.2
0.7.0-alpha.2
cggmp21
crates.io
 0.0.0-0 and later None known
cggmp24
crates.io
 0.0.0-0 up to 0.7.0-alpha.2
0.7.0-alpha.2

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-66017 is a high vulnerability (CVSS 8.2) in Lfdt-lockness Cggmp21, published November 24, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 13th percentile. Fixed in cggmp24 0.7.0-alpha.2.

References

Show 5 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open