{"id":"CVE-2026-24783","aliases":["EUVD-2026-4710","GHSA-x5m4-43jf-hh65"],"status":"published","title":"soroban-fixed-point-math has Incorrect Rounding and Overflow Handling in Signed Fixed-Point Math with Negatives","description":"soroban-fixed-point-math is a fixed-point math library for Soroban smart contacts. In versions 1.3.0 and 1.4.0, the `mulDiv(x, y, z)` function incorrectly handled cases where both the intermediate product $x * y$ and the divisor $z$ were negative. The logic assumed that if the intermediate product was negative, the final result must also be negative, neglecting the sign of $z$. This resulted in rounding being applied in the wrong direction for cases where both $x * y$ and $z$ were negative. The functions most at risk are `fixed_div_floor` and `fixed_div_ceil`, as they often use non-constant numbers as the divisor $z$ in `mulDiv`.  This error is present in all signed `FixedPoint` and `SorobanFixedPoint` implementations, including `i64`, `i128`, and `I256`. Versions 1.3.1 and 1.4.1 contain a patch. No known workarounds for this issue are available.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00405,"percentile":0.35055,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-682"],"published":"2026-01-27T22:04:18Z","modified":"2026-10-28T02:31:02Z","fixes":[{"ecosystem":"crates.io","package":"soroban-fixed-point-math","fixed_in":["1.4.1","1.3.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"soroban-fixed-point-math","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.0"},{"last_affected":"1.4.0"},{"fixed":"1.4.1"}]}],"versions":["1.4.0"]},{"source":"ghsa","ecosystem":"crates.io","package":"soroban-fixed-point-math","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"last_affected":"1.3.0"},{"fixed":"1.3.1"}]}],"versions":["1.3.0"]},{"source":"osv","ecosystem":"crates.io","package":"soroban-fixed-point-math","ranges":[{"type":"SEMVER","events":[{"introduced":"1.4.0"},{"fixed":"1.4.1"}]}],"versions":["1.4.0"]},{"source":"osv","ecosystem":"crates.io","package":"soroban-fixed-point-math","ranges":[{"type":"SEMVER","events":[{"introduced":"1.3.0"},{"fixed":"1.3.1"}]}],"versions":["1.3.0"]}],"products":[{"vendor":"script3","product":"soroban-fixed-point-math"}],"references":[{"url":"https://github.com/script3/soroban-fixed-point-math/security/advisories/GHSA-x5m4-43jf-hh65","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://github.com/script3/soroban-fixed-point-math/commit/c9233f7094198a49ed66a4d75786a8a3755c936a","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/script3/soroban-fixed-point-math/releases/tag/v1.3.1","tags":["x_refsource_MISC","Product","Release Notes","web"]},{"url":"https://github.com/script3/soroban-fixed-point-math/releases/tag/v1.4.1","tags":["x_refsource_MISC","Product","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24783","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-x5m4-43jf-hh65"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24783.json","tags":["advisory"]},{"url":"https://github.com/script3/soroban-fixed-point-math","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-24783","title":"soroban-fixed-point-math has Incorrect Rounding and Overflow Handling in Signed Fixed-Point Math with Negatives","description":"soroban-fixed-point-math is a fixed-point math library for Soroban smart contacts. In versions 1.3.0 and 1.4.0, the `mulDiv(x, y, z)` function incorrectly handled cases where both the intermediate product $x * y$ and the divisor $z$ were negative. The logic assumed that if the intermediate product was negative, the final result must also be negative, neglecting the sign of $z$. This resulted in rounding being applied in the wrong direction for cases where both $x * y$ and $z$ were negative. The functions most at risk are `fixed_div_floor` and `fixed_div_ceil`, as they often use non-constant numbers as the divisor $z$ in `mulDiv`.  This error is present in all signed `FixedPoint` and `SorobanFixedPoint` implementations, including `i64`, `i128`, and `I256`. Versions 1.3.1 and 1.4.1 contain a patch. No known workarounds for this issue are available.","status":"published","published":"2026-01-27T22:04:18.006Z","modified":"2026-01-28T21:09:12.428Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-682"],"updated_at":"2026-11-02T14:19:50.575061Z"}],"euvd":[{"id":"EUVD-2026-4710","description":"soroban-fixed-point-math is a fixed-point math library for Soroban smart contacts. In versions 1.3.0 and 1.4.0, the `mulDiv(x, y, z)` function incorrectly handled cases where both the intermediate product $x * y$ and the divisor $z$ were negative. The logic assumed that if the intermediate product was negative, the final result must also be negative, neglecting the sign of $z$. This resulted in rounding being applied in the wrong direction for cases where both $x * y$ and $z$ were negative. The functions most at risk are `fixed_div_floor` and `fixed_div_ceil`, as they often use non-constant numbers as the divisor $z$ in `mulDiv`.  This error is present in all signed `FixedPoint` and `SorobanFixedPoint` implementations, including `i64`, `i128`, and `I256`. Versions 1.3.1 and 1.4.1 contain a patch. No known workarounds for this issue are available.","status":"published","published":"2026-01-27T22:04:18Z","modified":"2026-01-28T21:09:12Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T19:48:45.944715Z"}],"ghsa":[{"id":"GHSA-x5m4-43jf-hh65","title":"soroban-fixed-point-math has Incorrect Rounding and Overflow Handling in Signed Fixed-Point Math with Negatives","description":"### Impact\n\n#### Incorrect rounding direction for signed mul and div operations\n\nThe `mulDiv(x, y, z)` function incorrectly handled cases where both the intermediate product $x * y$ and the divisor $z$ were negative. The logic assumed that if the intermediate product was negative, the final result must also be negative, neglecting the sign of $z$.\n\nThis resulted in rounding being applied in the wrong direction for cases where both $x * y$ and $z$ were negative. The functions most at risk are `fixed_div_floor` and `fixed_div_ceil`, as they often use non-constant numbers as the divisor $z$ in `mulDiv`. \n\nThis error is present in all signed `FixedPoint` and `SorobanFixedPoint` implementations, including `i64`, `i128`, and `I256`.\n\n#### Negative Overflow in `i64`\n\nThe `mulDiv(x, y, z)` function for `i64` used the `i128` type to handle \"phantom overflows\". These are overflows that occur intermediately during a calculation, like when computing the intermediate product $x * y$. When the final result of `mulDiv` was computed in `i128`, it was scaled back down to `i64` before returning. While the code verified that the result did not exceed `i64::MAX`, it did not check against `i64::MIN`.\n\nThis caused negative results smaller than `i64:MIN` to wrap around to a large positive number instead of being caught as an overflow.\n\nThis error only exists for the `FixedPoint` implementation of `i64`. \n\n### Patches\n\n* v1.3.0 users should upgrade to patch v1.3.1\n* v1.4.0 users should upgrade to patch v1.4.1\n\nAll versions `\u003e=v1.4.1` contain the patch. \n\n### Workarounds\nThere are no known workarounds. Upgrade to the patched version.\n\n### Credits\n\nsoroban-fixed-point-math would like to thank the team at [Certora](https://www.certora.com/) for discovering and reporting the issue.","status":"published","published":"2026-01-28T16:18:54Z","modified":"2026-01-28T16:18:55Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-682"],"updated_at":"2026-11-02T14:39:20.563096Z"}],"nvd":[{"id":"CVE-2026-24783","description":"soroban-fixed-point-math is a fixed-point math library for Soroban smart contacts. In versions 1.3.0 and 1.4.0, the `mulDiv(x, y, z)` function incorrectly handled cases where both the intermediate product $x * y$ and the divisor $z$ were negative. The logic assumed that if the intermediate product was negative, the final result must also be negative, neglecting the sign of $z$. This resulted in rounding being applied in the wrong direction for cases where both $x * y$ and $z$ were negative. The functions most at risk are `fixed_div_floor` and `fixed_div_ceil`, as they often use non-constant numbers as the divisor $z$ in `mulDiv`.  This error is present in all signed `FixedPoint` and `SorobanFixedPoint` implementations, including `i64`, `i128`, and `I256`. Versions 1.3.1 and 1.4.1 contain a patch. No known workarounds for this issue are available.","status":"published","published":"2026-01-27T22:15:57.433Z","modified":"2026-06-17T10:23:35.253Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-682"],"updated_at":"2026-11-02T14:12:04.769088Z"}],"osv":[{"id":"CVE-2026-24783","title":"soroban-fixed-point-math has Incorrect Rounding and Overflow Handling in Signed Fixed-Point Math with Negatives","description":"soroban-fixed-point-math is a fixed-point math library for Soroban smart contacts. In versions 1.3.0 and 1.4.0, the `mulDiv(x, y, z)` function incorrectly handled cases where both the intermediate product $x * y$ and the divisor $z$ were negative. The logic assumed that if the intermediate product was negative, the final result must also be negative, neglecting the sign of $z$. This resulted in rounding being applied in the wrong direction for cases where both $x * y$ and $z$ were negative. The functions most at risk are `fixed_div_floor` and `fixed_div_ceil`, as they often use non-constant numbers as the divisor $z$ in `mulDiv`.  This error is present in all signed `FixedPoint` and `SorobanFixedPoint` implementations, including `i64`, `i128`, and `I256`. Versions 1.3.1 and 1.4.1 contain a patch. No known workarounds for this issue are available.","status":"published","published":"2026-01-27T22:04:18.006Z","modified":"2026-10-28T02:31:02.705107347Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-682"],"updated_at":"2026-11-02T15:44:59.438965Z"},{"id":"GHSA-x5m4-43jf-hh65","title":"soroban-fixed-point-math has Incorrect Rounding and Overflow Handling in Signed Fixed-Point Math with Negatives","description":"### Impact\n\n#### Incorrect rounding direction for signed mul and div operations\n\nThe `mulDiv(x, y, z)` function incorrectly handled cases where both the intermediate product $x * y$ and the divisor $z$ were negative. The logic assumed that if the intermediate product was negative, the final result must also be negative, neglecting the sign of $z$.\n\nThis resulted in rounding being applied in the wrong direction for cases where both $x * y$ and $z$ were negative. The functions most at risk are `fixed_div_floor` and `fixed_div_ceil`, as they often use non-constant numbers as the divisor $z$ in `mulDiv`. \n\nThis error is present in all signed `FixedPoint` and `SorobanFixedPoint` implementations, including `i64`, `i128`, and `I256`.\n\n#### Negative Overflow in `i64`\n\nThe `mulDiv(x, y, z)` function for `i64` used the `i128` type to handle \"phantom overflows\". These are overflows that occur intermediately during a calculation, like when computing the intermediate product $x * y$. When the final result of `mulDiv` was computed in `i128`, it was scaled back down to `i64` before returning. While the code verified that the result did not exceed `i64::MAX`, it did not check against `i64::MIN`.\n\nThis caused negative results smaller than `i64:MIN` to wrap around to a large positive number instead of being caught as an overflow.\n\nThis error only exists for the `FixedPoint` implementation of `i64`. \n\n### Patches\n\n* v1.3.0 users should upgrade to patch v1.3.1\n* v1.4.0 users should upgrade to patch v1.4.1\n\nAll versions `\u003e=v1.4.1` contain the patch. \n\n### Workarounds\nThere are no known workarounds. Upgrade to the patched version.\n\n### Credits\n\nsoroban-fixed-point-math would like to thank the team at [Certora](https://www.certora.com/) for discovering and reporting the issue.","status":"published","published":"2026-01-28T16:18:54Z","modified":"2026-02-03T03:06:39.687842Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-682"],"updated_at":"2026-11-02T15:46:59.484835Z"}]}}