CVE-2026-48486: CWE-190: Integer Overflow or Wraparound in signum-network signum-node

Signum-node, a HDD-mined cryptocurrency client, contained an integer overflow in the BlockServiceImpl.applyBlock() function before version 3.9.9. This vulnerability allowed miners to exploit a negative totalFeeCashBackNqt value to receive inflated block rewards. The vulnerability originated from the SMART_FEES hardfork (block ~1,029,000) which introduced fee cashback and burn accounting but lacked overflow protections. The flaw is classified under CWE-190 (Integer Overflow or Wraparound). The vulnerability has been patched in version 3.9.9.

An attacker who is a miner can exploit this vulnerability to receive arbitrarily inflated block rewards by crafting blocks with manipulated negative fee cashback values. This compromises the integrity of the blockchain's economic incentives and could lead to inflation of the cryptocurrency supply. There is no indication of confidentiality or availability impact. No known exploits in the wild have been reported.

Upgrade signum-node to version 3.9.9 or later, where the integer overflow vulnerability in BlockServiceImpl.applyBlock() has been patched. Since the vendor advisory indicates the issue is fixed in 3.9.9, applying this official fix fully mitigates the vulnerability.