{"id":"CVE-2026-112041","kind":"vulnerability","aliases":["CVE-2026-112041"],"related":[],"title":"diem PHP: dmString::random uses a cryptographically weak PRNG","description":"A vulnerability was identified in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. This vulnerability affects the function dmString::random of the file dmCorePlugin/lib/basic/dmString.php. Such manipulation leads to cryptographically weak prng. The attack may be performed from remote. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The exploit is publicly available and might be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.","summary":"The dmString::random helper in diem's dmCorePlugin generates strings with a non-cryptographic random number generator. An attacker who can observe enough outputs may be able to predict values that the application expects to be secret or unguessable.","severity":"low","cvss":3.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["diem","package","php"],"not_affected_if":["no-security-use-of-random"],"how_to_check":"- Search the codebase for calls to `dmString::random` in `dmCorePlugin/lib/basic/dmString.php`.\n- Check whether the output is used for tokens, passwords, reset links or session identifiers.","fix":null,"status":"open","published_at":"2026-10-19T02:17:06+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T04:45:15+00:00","updated_at":"2026-10-25T04:45:15+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T04:45:15Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"diem PHP: dmString::random uses a cryptographically weak PRNG","impact":"medium","summary":"The dmString::random helper in diem's dmCorePlugin generates strings with a non-cryptographic random number generator. An attacker who can observe enough outputs may be able to predict values that the application expects to be secret or unguessable.","category":"package","nicknames":[],"who_cares":["php","diem"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker predicts generated tokens and takes over accounts","analyst_note":"Confirm which call sites use dmString::random for tokens or secrets, and check the NVD entry for a fixed commit or release.","how_to_check":"- Search the codebase for calls to `dmString::random` in `dmCorePlugin/lib/basic/dmString.php`.\n- Check whether the output is used for tokens, passwords, reset links or session identifiers.","needs_analyst":true,"not_affected_if":["no-security-use-of-random"],"who_is_affected":"Only applications built on diem that call dmString::random for security-sensitive values are exposed. The sources do not name a fixed release, and the project has not responded to the report. Installations that never call this helper for secrets can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000583,"input_tokens":3450,"output_tokens":476,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-112041':12A,15A '-2026':11A,14A '116974edfb9a5b8bd69cb13586dc62bcdbb485ad':70C 'abl':46B 'affect':73C,138C 'applic':52B 'associ':101C 'attack':38B,90C,104C 'avail':117C 'complex':98C 'continu':130C 'cryptograph':7A,33B,86C 'cve':10A,13A 'deliveri':131C 'diem':1A,16B,24B,65C,67C 'diem-project':64C 'difficult':112C 'disclos':144C 'dmcoreplugin':26B 'dmcoreplugin/lib/basic/dmstring.php':81C 'dmstring':3A,20B,76C 'earli':152C 'enough':42B 'expect':53B 'exploit':110C,114C 'file':80C 'function':75C 'generat':27B,36B 'helper':22B 'high':97C 'identifi':62C 'inform':136C,148C 'issu':155C 'lead':84C 'level':99C 'manipul':83C 'may':44B,91C 'might':119C 'non':32B 'non-cryptograph':31B 'number':35B 'observ':41B 'output':43B 'packag':17B 'perform':93C 'php':2A,18B 'predict':48B 'prng':9A,88C 'problem':151C 'product':123C 'project':66C,146C 'public':116C 'random':4A,21B,34B,77C 'releas':127C,141C 'remot':95C 'report':156C 'respond':160C 'roll':126C 'secret':56B 'state':107C 'string':28B 'system':128C 'unguess':58B 'updat':140C 'use':5A,121C 'util':124C 'valu':49B 'version':135C 'vulner':60C,72C 'weak':8A,87C 'yet':161C","nicknames":[],"mitigations":[],"who_affected":"Only applications built on diem that call dmString::random for security-sensitive values are exposed. The sources do not name a fixed release, and the project has not responded to the report. Installations that never call this helper for secrets can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T02:17:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112041","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112041","severity":null,"published_at":"2026-10-19T02:17:06+00:00","modified_at":"2026-10-19T18:17:01+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}