CVE-2026-24783 Details
Description
soroban-fixed-point-math is a fixed-point math library for Soroban smart contacts. In versions 1.3.0 and 1.4.0, the `mulDiv(x, y, z)` function incorrectly handled cases where both the intermediate product $x * y$ and the divisor $z$ were negative. The logic assumed that if the intermediate product was negative, the final result must also be negative, neglecting the sign of $z$. This resulted in rounding being applied in the wrong direction for cases where both $x * y$ and $z$ were negative. The functions most at risk are `fixed_div_floor` and `fixed_div_ceil`, as they often use non-constant numbers as the divisor $z$ in `mulDiv`. This error is present in all signed `FixedPoint` and `SorobanFixedPoint` implementations, including `i64`, `i128`, and `I256`. Versions 1.3.1 and 1.4.1 contain a patch. No known workarounds for this issue are available.
A vulnerability exists in the Soroban fixed-point math library for smart contracts, specifically in versions 1.3.0 and 1.4.0. The issue arises in the 'mulDiv(x, y, z)' function, which improperly manages cases where both the intermediate product (x * y) and the divisor (z) are negative. The function's logic mistakenly assumes that a negative intermediate product implies a negative final result, disregarding the sign of z. This flaw leads to incorrect rounding in functions like 'fixed_div_floor' and 'fixed_div_ceil', which frequently use variable numbers as the divisor z in 'mulDiv'. The vulnerability affects all signed 'FixedPoint' and 'SorobanFixedPoint' implementations, including 'i64', 'i128', and 'I256'.
Users of version 1.3.0 should upgrade to 1.3.1, and users of version 1.4.0 should upgrade to 1.4.1. All versions 1.4.1 and above include the patch.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-682 | Incorrect Calculation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| script3 soroban-fixed-point-math | 1.3.0 1.4.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 2, 2026 | Initial Analysis | [email protected] |
| Jan 27, 2026 | New CVE Received | [email protected] |