Threat database

CVE-2026-24783 is a high-severity vulnerability in the soroban-fixed-point-math library versions 1.3.0 and 1.4.0, used for fixed-point arithmetic in Soroban smart contracts. The mulDiv(x, y, z) function incorrectly calculates results when both the intermediate product (x * y) and divisor (z) are negative, causing rounding errors in fixed_div_floor and fixed_div_ceil functions. This flaw affects all signed FixedPoint implementations (i64, i128, I256). Exploitation can lead to integrity issues in smart contract computations, potentially causing financial miscalculations or logic errors. No known exploits exist yet, but patched versions 1.3.