Threats affecting pkg:cargo/github/nimiq/nimiq-account

CVE-2026-34064 is an integer underflow vulnerability in the nimiq-account Rust implementation prior to version 1.3.0. The issue occurs in the VestingContract::can_change_balance function, where an underflow panic can crash the node if an attacker creates a vesting contract with a total_amount exceeding the actual contract balance. This leads to a panic during mempool admission and block processing when an outgoing transaction triggers the vulnerable code path. The vulnerability has a medium severity with a CVSS score of 5.3. A patch fixing this issue is included in version 1.3.0.