CVE-2025-54426

CRITICAL

Polkadot Frontier <commit 36f70d1 - Info Disclosure

Title source: llm
STIX 2.1

Description

Polkadot Frontier is an Ethereum and EVM compatibility layer for Polkadot and Substrate. In versions prior to commit 36f70d1, the Curve25519Add and Curve25519ScalarMul precompiles incorrectly handle invalid Ristretto point representations. Instead of returning an error, they silently treat invalid input bytes as the Ristretto identity element, leading to potentially incorrect cryptographic results. This is fixed in commit 36f70d1.

References (4)

Core 4

Scores

CVSS v4 9.9
EPSS 0.0030
EPSS Percentile 21.0%
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:H/SA:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-327
Status published
Products (1)
polkadot-evm/frontier < 36f70d1
Published Jul 28, 2025
Tracked Since Feb 18, 2026