A buffer over-read vulnerability in Binance Trust Wallet Core allows remote, unauthenticated attackers to trigger a Denial of Service condition.

This is a buffer over-read vulnerability located in the PublicKey::verify method. The issue is reachable by unauthenticated attackers who provide a crafted input to the affected library.

The primary risk associated with this vulnerability is the potential for service disruption. By triggering the buffer over-read, an attacker can crash the application or the specific service component relying on Trust Wallet Core, leading to a Denial of Service. While the CVSS score of 7.5 reflects a high severity due to the ease of remote exploitation, the impact is primarily limited to availability rather than data confidentiality or integrity.

Immediate Action: Update the Trust Wallet Core library to commit 5668c67 or later to incorporate the necessary memory safety fixes.

Proactive Monitoring: Monitor application logs for unexpected crashes, segmentation faults, or abnormal error rates associated with public key verification processes.

Compensating Controls: Implement input validation at the application boundary to sanitize inputs before they reach the PublicKey::verify method, which may help mitigate the risk of processing malicious payloads.

Public Exploit Available: Yes, a proof-of-concept exists as documented in the provided GitHub Gist reference.

Given the availability of a proof-of-concept and the potential for service disruption, organizations integrating Trust Wallet Core should prioritize updating their dependencies. Ensure that all development and production environments transition to the patched version of the library to eliminate this vulnerability and maintain system stability.