{"uuid": "55d775ed-892a-4dc9-b302-903a890ab84f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71851", "type": "seen", "source": "https://gist.github.com/alon710/fa679955da8f3503916dff57f8688b8c", "content": "# CVE-2026-71851: CVE-2026-71851: Use of Cryptographically Weak PRNG in crypto-js (Ill Bloom)\n\n> **CVSS Score:** 9.0\n> **Published:** 2026-08-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71851\n\n## Summary\nA severe, twelve-year-old cryptographic weakness in crypto-js (versions < 4.0.0) generated pseudorandom numbers using a custom Multiply-With-Carry (MWC) algorithm seeded from the non-secure Math.random(). This reduces 128-bit and 256-bit key spaces to just 2^39 and 2^47 possibilities, allowing offline brute-force attacks.\n\n## TL;DR\nLegacy versions of crypto-js generate weak keys using Math.random() in a custom MWC generator, enabling attackers to systematically brute-force and drain cryptocurrency wallets.\n\n## Exploit Status: ACTIVE\n\n## Technical Details\n\n- **CWE ID**: CWE-338\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 9.0 (Critical)\n- **Exploit Status**: Active In-The-Wild\n- **Primary Impact**: Private Key Compromise and Asset Theft\n- **Component**: CryptoJS.lib.WordArray.random()\n\n## Affected Systems\n\n- crypto-js <= 3.3.0\n- Legacy web3 wallets\n- Decentralized browser extensions using crypto-js 3.x\n- Hybrid mobile applications bundling legacy crypto-js dependencies\n- **crypto-js**: >= 3.1.2-4, < 4.0.0 (Fixed in: `4.0.0`)\n\n## Mitigation\n\n- Upgrade crypto-js dependency to version 4.0.0 or higher.\n- Implement platform-native secure random generation APIs.\n- Rotate all cryptographic keys and seed phrases generated under vulnerable versions.\n\n**Remediation Steps:**\n1. Verify installed dependencies using npm ls crypto-js.\n2. Upgrade packages to version 4.0.0 or later.\n3. Generate new mnemonic phrases and migrate wallet assets to fresh addresses.\n\n## References\n\n- [Ill Bloom Dedicated Research & Address Checker](https://illbloom.org/)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71851) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-07T21:31:50.457897Z"}