CVE-2026-24889

soroban-sdk is a Rust SDK for Soroban contracts. Arithmetic overflow can be triggered in the `Bytes::slice`, `Vec::slice`, and `Prng::gen_range` (for `u64`) methods in the `soroban-sdk` in versions up to and including `25.0.1`, `23.5.1`, and `25.0.2`. Contracts that pass user-controlled or computed range bounds to `Bytes::slice`, `Vec::slice`, or `Prng::gen_range` may silently operate on incorrect data ranges or generate random numbers from an unintended range, potentially resulting in corrupted contract state. Note that the best practice when using the `soroban-sdk` and building Soroban contracts is to always enable `overflow-checks = true`. The `stellar contract init` tool that prepares the boiler plate for a Soroban contract, as well as all examples and docs, encourage the use of configuring `overflow-checks = true` on `release` profiles so that these arithmetic operations fail rather than silently wrap. Contracts are only impacted if they use `overflow-checks = false` either explicitly or implicitly. It is anticipated the majority of contracts could not be impacted because the best practice encouraged by tooling is to enable `overflow-checks`. The fix available in `25.0.1`, `23.5.1`, and `25.0.2` replaces bare arithmetic with `checked_add` / `checked_sub`, ensuring overflow traps regardless of the `overflow-checks` profile setting. As a workaround, contract workspaces can be configured with a profile available in the GitHub Securtity Advisory to enable overflow checks on the arithmetic operations. This is the best practice when developing Soroban contracts, and the default if using the contract boilerplate generated using `stellar contract init`. Alternatively, contracts can validate range bounds before passing them to `slice` or `gen_range` to ensure the conversions cannot overflow.

• CWE-190

• https://github.com/stellar/rs-soroban-sdk/commit/3890521426d71bb4d892b21f5a283a1e836cfa38Patch
• https://github.com/stellar/rs-soroban-sdk/commit/59fcef437260ed4da42d1efb357137a5c166c02ePatch
• https://github.com/stellar/rs-soroban-sdk/commit/c2757c6d774dbb28b34a0b77ffe282e59f0f8462Patch
• https://github.com/stellar/rs-soroban-sdk/pull/1703Issue Tracking, Patch
• https://github.com/stellar/rs-soroban-sdk/releases/tag/v22.0.9Product, Release Notes
• https://github.com/stellar/rs-soroban-sdk/releases/tag/v23.5.1Product, Release Notes
• https://github.com/stellar/rs-soroban-sdk/releases/tag/v25.0.2Product, Release Notes
• https://github.com/stellar/rs-soroban-sdk/security/advisories/GHSA-96xm-fv9w-pf3fMitigation, Patch, Vendor Advisory

Published

Jan 28, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-24882In GnuPG before 2.5.17, a stack-based buffer overflow exists…7.8
• CVE-2026-24883In GnuPG before 2.5.17, a long signature packet length cause…5.5
• CVE-2026-24884Compressing is a compressing and uncompressing lib for node.…7.8
• CVE-2026-24885Kanboard is project management software focused on Kanban me…8
• CVE-2026-24887Claude Code is an agentic coding tool. Prior to version 2.0.…8.8
• CVE-2026-24888Maker.js is a 2D vector line drawing and shape modeling for …9.8
• CVE-2026-2489The TP2WP Importer plugin for WordPress is vulnerable to Sto…4.4
• CVE-2026-24890OpenEMR is a free and open source electronic health records …6.5
• CVE-2026-24891openITCOCKPIT is an open source monitoring tool built for di…7.5
• CVE-2026-24892openITCOCKPIT is an open source monitoring tool built for di…8.8
• CVE-2026-24893openITCOCKPIT is an open source monitoring tool built for di…8.8
• CVE-2026-24894FrankenPHP is a modern application server for PHP. Prior to …7.5