GCVE - cpe:2.3:a:trustwallet:trust_wallet_core:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:trustwallet:trust_wallet_core:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Trustwallet (`0b5a7954-afc7-5516-8c45-24dbe7f5edda`)
Product	Trust Wallet Core (`de479983-fe03-5d56-b1a9-cda59aecbc0e`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/trustwallet/wallet-core`	purl2cpe	2026-06-01 10:11:10.523302
`pkg:golang/github.com/trustwallet/wallet-core`	purl2cpe	2026-06-01 10:11:10.523304

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-66692`	vulnerable	2026-06-08 07:41:19.459414	Details available A buffer over-read in the PublicKey::verify() method of Binance - Trust Wallet Core before commit 5668c67 allows attackers to cause a Denial of Service (DoS) via a crafted input. Published: 2026-01-20T00:00:00.000Z Updated: 2026-01-21T16:40:24.978Z Open on db.gcve.eu Reference links https://github.com/trustwallet/wallet-core/commit/5668c67 https://gist.github.com/inkman97/b791189338f73b758c31a7db3cd50c2d	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-31290`	vulnerable	2026-06-08 06:04:42.490147	Details available Trust Wallet Core before 3.1.1, as used in the Trust Wallet browser extension before 0.0.183, allows theft of funds because the entropy is 32 bits, as exploited in the wild in December 2022 and March 2023. This occurs because the mt19937 Mersenne Twister takes a single 32-bit value as an input seed, resulting in only four billion possible mnemonics. The affected versions of the browser extension are 0.0.172 through 0.0.182. To steal funds efficiently, an attacker can identify all Ethereum addresses created since the 0.0.172 release, and check whether they are Ethereum addresses that could have been created by this extension. To respond to the risk, affected users need to upgrade the product version and also move funds to a new wallet address. Published: 2023-04-27T00:00:00.000Z Updated: 2025-01-30T20:19:42.908Z Open on db.gcve.eu Reference links https://community.trustwallet.com/t/browser-extension-wasm-vulnerability-postmortem/750787 https://community.trustwallet.com/t/wasm-vulnerability-incident-update-and-recommended-actions/750786 https://github.com/trustwallet/wallet-core/compare/3.1.0...3.1.1 https://twitter.com/TrustWallet/status/1649699428733947906 https://blog.ledger.com/Funds-of-every-wallet-created-with-the-Trust-Wallet-browser-extension-could-have-been-stolen/	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.