CVE-2026-4931 CVE-2026-4931
Attackers can exploit unsafe downcasting in Marginal v1 smart contracts to settle large debts for negligible cost, impacting financial integrity.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-4931?
CVE-2026-4931 is a medium-severity vulnerability in Marginal Smart Contract, published on 7 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Smart contract Marginal v1 performs unsafe downcast, allowing attackers to settle a large debt position for a negligible asset cost.
Weakness: CWE-681
Which versions are affected by CVE-2026-4931?
It affects 1 product.
Products include Marginal V1-Core.
How do I fix CVE-2026-4931?
No fix has been published for CVE-2026-4931 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-4931 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-4931 exists.
Sources
Also known as GHSA-x4xq-7w28-q486.