script3 soroban-fixed-point-math 1.3.0/1.4.0 fixed_div_floor/fixed_div_ceil calculation

Summaryinfo

A vulnerability marked as problematic has been reported in script3 soroban-fixed-point-math 1.3.0/1.4.0. The affected element is the function fixed_div_floor/fixed_div_ceil. The manipulation leads to calculation. This vulnerability is documented as CVE-2026-24783. The attack can be initiated remotely. There is not any exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in script3 soroban-fixed-point-math 1.3.0/1.4.0. It has been rated as problematic. This issue affects the function fixed_div_floor/fixed_div_ceil. The manipulation with an unknown input leads to a calculation vulnerability. Using CWE to declare the problem leads to CWE-682. The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management. Impacted is integrity. The summary by CVE is:

soroban-fixed-point-math is a fixed-point math library for Soroban smart contacts. In versions 1.3.0 and 1.4.0, the `mulDiv(x, y, z)` function incorrectly handled cases where both the intermediate product $x * y$ and the divisor $z$ were negative. The logic assumed that if the intermediate product was negative, the final result must also be negative, neglecting the sign of $z$. This resulted in rounding being applied in the wrong direction for cases where both $x * y$ and $z$ were negative. The functions most at risk are `fixed_div_floor` and `fixed_div_ceil`, as they often use non-constant numbers as the divisor $z$ in `mulDiv`. This error is present in all signed `FixedPoint` and `SorobanFixedPoint` implementations, including `i64`, `i128`, and `I256`. Versions 1.3.1 and 1.4.1 contain a patch. No known workarounds for this issue are available.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-24783 since 01/26/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 1.3.1 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch c9233f7094198a49ed66a4d75786a8a3755c936a is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-4710). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• script3

Name

• soroban-fixed-point-math

Version

• 1.3.0
• 1.4.0

License

• open-source

Website

• Product: https://github.com/script3/soroban-fixed-point-math/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion