CVE-2026-24783VulnerabilityPublished 27 Jan 2026

CVE-2026-24783: script3 soroban-fixed-point-math · Incorrect Calculation

Affects script3 soroban-fixed-point-mathSource CVE Database V5

Not known to be exploited · CVSS 7.5 High.

Data as of 25 Oct 2026, 19:02 UTC

CVSS 3.1 base score

7.5High

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.4% chance of exploitation in 30 days – higher than 34% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: High
Availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: None: There is no loss of confidentiality within the impacted component.
Integrity: High: There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the impacted component. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the impacted component.
Availability: None: There is no impact to availability within the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 27 Jan 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
script3soroban-fixed-point-math	Affected =1.4.0 =1.3.0	Fixed in–
GitHubscript3/soroban-fixed-point-math`pkg:github/script3/soroban-fixed-point-math`Other threats	Affected =1.3.0 =1.4.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

European organizations should immediately upgrade any usage of soroban-fixed-point-math library from versions 1.3.0 or 1.4.0 to the patched versions 1.3.1 or 1.4.1. Conduct a thorough audit of all Soroban smart contracts that use fixed-point arithmetic to identify potential reliance on vulnerable functions such as mulDiv, fixed_div_floor, and fixed_div_ceil. Implement rigorous testing and validation of contract logic post-update to ensure correct rounding behavior. Where feasible, introduce additional contract-level checks or constraints to detect anomalous results from arithmetic operations. Engage with blockchain developers and auditors to review contract code for similar logic errors. Monitor blockchain transaction patterns for unusual contract behavior that could indicate exploitation attempts. Finally, maintain an up-to-date inventory of smart contract dependencies and apply security patches promptly.

Description

CVE-2026-24783 is a high-severity vulnerability in the soroban-fixed-point-math library versions 1.3.0 and 1.4.0, used for fixed-point arithmetic in Soroban smart contracts. The mulDiv(x, y, z) function incorrectly calculates results when both the intermediate product (x * y) and divisor (z) are negative, causing rounding errors in fixed_div_floor and fixed_div_ceil functions. This flaw affects all signed FixedPoint implementations (i64, i128, I256). Exploitation can lead to integrity issues in smart contract computations, potentially causing financial miscalculations or logic errors. No known exploits exist yet, but patched versions 1.3.

Impact

For European organizations leveraging Soroban smart contracts, especially in financial services, decentralized finance (DeFi), and blockchain-based applications, this vulnerability poses a significant risk to the integrity of contract computations. Incorrect rounding can lead to financial discrepancies, erroneous contract states, or unintended contract executions, potentially resulting in monetary loss or reputational damage. Since Soroban is a smart contract platform, errors in fixed-point math can be exploited by adversaries to manipulate contract logic or outcomes without breaching confidentiality or availability. This undermines trust in blockchain applications and can disrupt business operations relying on precise financial calculations. The lack of known exploits suggests the threat is currently theoretical but patching is critical to prevent future attacks. Organizations failing to update may face risks of contract manipulation, regulatory scrutiny, and financial penalties.

CWE-682Incorrect Calculation (opens in a new tab)
Pillar weaknessLikelihood of exploit: High
The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.
MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.
Implementation
Understand your programming language's underlying representation and how it interacts with numeric calculation. Pay close attention to byte size discrepancies, precision, signed/unsigned distinctions, truncation, conversion and casting between types, "not-a-number" calculations, and how your language handles numbers…
Implementation · Input Validation
Perform input validation on any numeric input by ensuring that it is within the expected range. Enforce that the input meets both the minimum and maximum requirements for the expected range.
Implementation
Use the appropriate type for the desired action. For example, in C/C++, only use unsigned types for values that could never be negative, such as height, width, or other numbers related to quantity.
Attack patterns
Integer Attacks (opens in a new tab)
Pointer Manipulation (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 4 Feb 2026, 09:15 UTC

WeaknessesCWE-682

Technical details

References

Community reviews

Related threats