CVE-2026-55764: CWE-190: Integer Overflow or Wraparound in klever-io klever-go

Klever-Go, the Go implementation of the Klever blockchain protocol, contained an integer overflow vulnerability (CWE-190) in versions prior to 1.7.19. The vulnerability exists in the semi-fungible token add-quantity path, where the circulation count is incremented without checking for signed int64 overflow before comparing against MaxSupply. This allows a mint-role holder to supply a large positive amount that causes the circulation count to wrap negative, bypassing the maximum supply check and crediting an excessive number of tokens (approximately MaxInt64). The fungible token path is unaffected due to a guard that detects overflow. The fix involves a consensus activation flag named FixMarketBuyOverflow and is included in version 1.7.19.

An attacker with mint-role privileges can exploit this vulnerability to bypass the maximum supply limit on semi-fungible tokens, potentially minting an extremely large number of tokens (around MaxInt64). This corrupts the on-chain token circulation counter and could undermine token supply integrity and blockchain state consistency. The fungible token minting path is not affected. There are no known exploits in the wild at this time.

This vulnerability is fixed in klever-go version 1.7.19. Users should upgrade to version 1.7.19 or later to remediate the issue. No other mitigation or temporary fix is documented. Since this is not a cloud service, remediation depends on applying the official fix.