CVE-2026-48486 Signum Node: Integer overflow in SMART_FEES fee distribution allows arbitrary miner reward inflation
A miner can exploit an integer overflow in fee distribution to arbitrarily inflate block rewards, compromising the cryptocurrency's economic integrity.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-48486?
CVE-2026-48486 is a high-severity vulnerability in signum-network signum-node, published on 3 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Signum Node is a HDD-mined cryptocurrency using an energy efficient and fair Proof-of-Commitment (PoC+) consensus algorithm. Prior to version 3.9.9, an integer overflow in BlockServiceImpl.applyBlock() allowed a miner to receive an arbitrarily inflated block reward by crafting a block with a negative totalFeeCashBackNqt value. The vulnerability was introduced when the SMART_FEES hardfork (block ~1,029,000) enabled fee cash-back and burn accounting without overflow protection. This issue has been patched in version 3.9.9.
Weakness: CWE-190
Which versions are affected by CVE-2026-48486?
How do I fix CVE-2026-48486?
No fix has been published for CVE-2026-48486 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-48486 being exploited?
There is no known exploitation of CVE-2026-48486 in the wild and no public exploit code.
Sources
Also known as GHSA-4vjp-2m22-r2q9.