What is CVE-2025-24800?

CVE-2025-24800 is a critical-severity security vulnerability in ismp-grandpa (rust), affecting versions < 15.0.1. It is fixed in 15.0.1, 0.1.2.

Which packages are affected by CVE-2025-24800?

ismp-grandpa (rust) versions < 15.0.1; grandpa-verifier-primitives (rust) versions < 0.1.2; grandpa-verifier (rust) versions < 0.1.2.

Is there a fix for CVE-2025-24800?

Yes. CVE-2025-24800 is fixed in 15.0.1, 0.1.2. Upgrade to this version or later.

Is CVE-2025-24800 exploitable, and should I be worried?

Whether CVE-2025-24800 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

What actually determines whether CVE-2025-24800 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

How do I fix CVE-2025-24800?

Upgrade: ismp-grandpa to 15.0.1 or later, grandpa-verifier-primitives to 0.1.2 or later, grandpa-verifier to 0.1.2 or later.

CVE-2025-24800 in ismp-grandpa

Q: Which packages are affected by CVE-2025-24800?

ismp-grandpa (rust) versions < 15.0.1; grandpa-verifier-primitives (rust) versions < 0.1.2; grandpa-verifier (rust) versions < 0.1.2.

Q: Is there a fix for CVE-2025-24800?

Yes. CVE-2025-24800 is fixed in 15.0.1, 0.1.2. Upgrade to this version or later.

Q: Is CVE-2025-24800 exploitable, and should I be worried?

Whether CVE-2025-24800 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

Q: What actually determines whether CVE-2025-24800 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

Q: How do I fix CVE-2025-24800?

Upgrade: ismp-grandpa to 15.0.1 or later, grandpa-verifier-primitives to 0.1.2 or later, grandpa-verifier to 0.1.2 or later.

Summary

ismp-grandpa crate accepted incorrect signatures

A critical vulnerability was discovered in the ismp-grandpa crate, that allowed a malicious prover easily convince the verifier of the finality of arbitrary headers.

Description

The vulnerability manifests as a verifer that only accepts incorrect signatures of Grandpa precommits and was introduced in this specific commit. Perhaps due to unfamiliarity with core substrate APIs. The if statement should have included a negation check, similar to the previous code, but this was omitted. Causing the verifier to only accept invalid signatures.

This vulnerability remained undetected even with integration tests, as the prover was also misconfigured to initialize the Grandpa verifier with the incorrect authority set_id. This causes verification of honest precommit signatures to fail as the message is now malformed, but the verifier indeed only accepts signatures or messages that fail the verification check.

But even more devastatingly, the verifier will also accept malicious GRANDPA signatures for any precommit message.

This vulnerability has been fixed in this commit and a patch release has been published.

Recommendations

Users who rely on the compromised versions must upgrade immediately, as all vulnerable versions of the crate has been yanked.

Impact

This could be used to steal funds or compromise other kinds of cross-chain applications.

Affected versions

ismp-grandpa (< 15.0.1) grandpa-verifier-primitives (< 0.1.2) grandpa-verifier (< 0.1.2)

Security releases

ismp-grandpa → 15.0.1 (rust) grandpa-verifier-primitives → 0.1.2 (rust) grandpa-verifier → 0.1.2 (rust)

Kodem intelligence

Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.

Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.

Already deployed Kodem?

See it in your environment New to Kodem? Get a demo →

Remediation advice

This vulnerability has been fixed in the latest version of ismp-granpda v15.0.1

Frequently Asked Questions

What is CVE-2025-24800? CVE-2025-24800 is a critical-severity security vulnerability in ismp-grandpa (rust), affecting versions < 15.0.1. It is fixed in 15.0.1, 0.1.2.
Which packages are affected by CVE-2025-24800?
- ismp-grandpa (rust) (versions < 15.0.1)
- grandpa-verifier-primitives (rust) (versions < 0.1.2)
- grandpa-verifier (rust) (versions < 0.1.2)
Is there a fix for CVE-2025-24800? Yes. CVE-2025-24800 is fixed in 15.0.1, 0.1.2. Upgrade to this version or later.
Is CVE-2025-24800 exploitable, and should I be worried? Whether CVE-2025-24800 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
What actually determines whether CVE-2025-24800 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
How do I fix CVE-2025-24800?
- Upgrade ismp-grandpa to 15.0.1 or later
- Upgrade grandpa-verifier-primitives to 0.1.2 or later
- Upgrade grandpa-verifier to 0.1.2 or later