{"answers":{"affected":"4 open source packages ship an affected version, including soroban-fixed-point-math. It affects 1 product.","exploited":"There is no known exploitation of CVE-2026-24783 in the wild and no public exploit code.","fix":"Upgrade soroban-fixed-point-math to a fixed version for your release line: 1.3.1 or 1.4.1.","what":"CVE-2026-24783 is a high-severity vulnerability in script3 soroban-fixed-point-math, published on 27 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-24783 and fix it if it is affected.\n\nWhat it is: CVE-2026-24783 is a high-severity vulnerability in script3 soroban-fixed-point-math, published on 27 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-24783 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- soroban-fixed-point-math (crates.io): affected from 1.3.0; fixed in 1.3.1\n- soroban-fixed-point-math (crates.io): affected from 1.3.0; fixed in 1.3.1\n- soroban-fixed-point-math (crates.io): affected from 1.4.0; fixed in 1.4.1\n- soroban-fixed-point-math (crates.io): affected from 1.4.0; fixed in 1.4.1\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-24783/ (Markdown: https://insights.sbomify.com/CVE-2026-24783/index.md)","id":"CVE-2026-24783","markdown":"https://insights.sbomify.com/CVE-2026-24783/index.md","name":"CVE-2026-24783","record":{"aliases":["GHSA-x5m4-43jf-hh65"],"analysis":{"component_type":"library","fix_type":"patch","impacts":["data_modify"],"network_reachable":"yes","non_default_config":false,"product_category":"Soroban math library","requires_auth":"none","summary":"Incorrect rounding in signed fixed-point division allows attackers to manipulate financial calculations in Soroban smart contracts.","user_interaction":"not_required","vuln_class":"other"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"soroban-fixed-point-math","vendor":"script3"}],"cvss":{"score":7.5,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"cwes":[{"id":"CWE-682","name":"Incorrect Calculation"}],"description":"soroban-fixed-point-math is a fixed-point math library for Soroban smart contacts. In versions 1.3.0 and 1.4.0, the `mulDiv(x, y, z)` function incorrectly handled cases where both the intermediate product $x * y$ and the divisor $z$ were negative. The logic assumed that if the intermediate product was negative, the final result must also be negative, neglecting the sign of $z$. This resulted in rounding being applied in the wrong direction for cases where both $x * y$ and $z$ were negative. The functions most at risk are `fixed_div_floor` and `fixed_div_ceil`, as they often use non-constant numbers as the divisor $z$ in `mulDiv`.  This error is present in all signed `FixedPoint` and `SorobanFixedPoint` implementations, including `i64`, `i128`, and `I256`. Versions 1.3.1 and 1.4.1 contain a patch. No known workarounds for this issue are available.","ecosystems":["crates.io"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"soroban-fixed-point-math has Incorrect Rounding and Overflow Handling in Signed Fixed-Point Math with Negatives","id":"CVE-2026-24783","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"crates.io","product":null,"products":[],"type":"other","year":"2026"},"n_packages":4,"n_references":4,"next":{"headline":"DotNetNuke.Core has a potential XSS vulnerability in modules' header and footer","id":"CVE-2026-24784"},"packages":[{"ecosystem":"crates.io","fixed":["1.3.1"],"introduced":["1.3.0"],"last_affected":[],"package":"soroban-fixed-point-math","purl":null,"source":"GHSA-x5m4-43jf-hh65"},{"ecosystem":"crates.io","fixed":["1.3.1"],"introduced":["1.3.0"],"last_affected":[],"package":"soroban-fixed-point-math","purl":"pkg:cargo/soroban-fixed-point-math","source":"GHSA-x5m4-43jf-hh65"},{"ecosystem":"crates.io","fixed":["1.4.1"],"introduced":["1.4.0"],"last_affected":[],"package":"soroban-fixed-point-math","purl":null,"source":"GHSA-x5m4-43jf-hh65"},{"ecosystem":"crates.io","fixed":["1.4.1"],"introduced":["1.4.0"],"last_affected":[],"package":"soroban-fixed-point-math","purl":"pkg:cargo/soroban-fixed-point-math","source":"GHSA-x5m4-43jf-hh65"}],"prev":{"headline":"Kiteworks Secure Data Forms has a SQL Injection vulnerability","id":"CVE-2026-24782"},"products":["soroban-fixed-point-math"],"published":"2026-01-27","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-01-28","vendors":["script3"]},"summary":"Incorrect rounding in signed fixed-point division allows attackers to manipulate financial calculations in Soroban smart contracts.","url":"https://insights.sbomify.com/CVE-2026-24783/"}