---
id: "CVE-2026-112041"
kind: "vulnerability"
aliases: ["CVE-2026-112041"]
title: "diem PHP: dmString::random uses a cryptographically weak PRNG"
severity: "low"
cvss: 3.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["diem", "package", "php"]
not_affected_if: ["no-security-use-of-random"]
published_at: "2026-10-19T02:17:06+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-25T04:45:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112041", "first_seen_at": "2026-10-23T21:57:17+00:00"}]
---

# diem PHP: dmString::random uses a cryptographically weak PRNG

The dmString::random helper in diem's dmCorePlugin generates strings with a non-cryptographic random number generator. An attacker who can observe enough outputs may be able to predict values that the application expects to be secret or unguessable.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Search the codebase for calls to `dmString::random` in `dmCorePlugin/lib/basic/dmString.php`.
- Check whether the output is used for tokens, passwords, reset links or session identifiers.

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112041

## From the sources

A vulnerability was identified in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. This vulnerability affects the function dmString::random of the file dmCorePlugin/lib/basic/dmString.php. Such manipulation leads to cryptographically weak prng. The attack may be performed from remote. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The exploit is publicly available and might be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_