PQC NIKE proposal and GPAC flaws

A new isogeny-based post-quantum key exchange was proposed with reference code, while two vulnerabilities were disclosed in the GPAC media toolkit. Oss-security also saw discussion of list volume handling and closure of a prior malware report.

MIKE module isogeny key exchange announced

Authors posted to the pqc-forum introducing MIKE, described as a fast and compact post-quantum non-interactive key exchange built on module isogenies. The announcement includes C and Rust implementations plus parameter discussion relative to SQIsign. Post-quantum developers evaluating NIKE constructions have concrete code and sizing data to review.

Heap buffer overflow in GPAC MP4Box

A single-message disclosure on oss-security reported CVE-2025-55640, a heap buffer overflow in GPAC MP4Box triggered via stbl_AddSize on crafted MP4 files with corrupted sample metadata. The issue carries a CVSS score of 8.8. Media-tool users importing untrusted MP4 content face a high-severity memory corruption risk.

Divide-by-zero crash in GPAC MP4Box

CVE-2025-55653 was reported for a divide-by-zero in GPAC MP4Box through gf_parse_lfrac when processing crafted MP4 files that contain a zero-denominator fraction. The fault produces a crash during metadata parsing. The same toolkit is affected by the concurrent buffer-overflow report.

Oss-security volume and digest proposal

Participants discussed consolidating high-volume vulnerability reports, such as those from Apache projects, into digests rather than splitting the list. The thread addressed concerns about traffic volume. Subscribers and maintainers have a concrete proposal for managing report load.

Fake-recruiter trojan report closed

A follow-up on oss-security stated that the taikotalent.xyz fake-recruiter trojan matter was resolved by a registrar clientHold dated 2026-10-10. Thread participants questioned the report's relevance to the list and criticized undisclosed LLM-generated posting. The exchange closes the earlier disclosure.