CVE-2026-48486
Last modified
CVE-2026-48486 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Signum Node is a HDD-mined cryptocurrency using an energy efficient and fair Proof-of-Commitment (PoC+) consensus algorithm. Prior to version 3.9.9, an integer overflow in BlockServiceImpl.applyBlock() allowed a miner to receive an arbitrarily inflated block reward by crafting a block with a negative totalFeeCashBackNqt value. EPSS estimates a 0.20% chance of exploitation in the next 30 days.
Description
Signum Node is a HDD-mined cryptocurrency using an energy efficient and fair Proof-of-Commitment (PoC+) consensus algorithm. Prior to version 3.9.9, an integer overflow in BlockServiceImpl.applyBlock() allowed a miner to receive an arbitrarily inflated block reward by crafting a block with a negative totalFeeCashBackNqt value. The vulnerability was introduced when the SMART_FEES hardfork (block ~1,029,000) enabled fee cash-back and burn accounting without overflow protection. This issue has been patched in version 3.9.9.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| signum-network | signum-node | < 3.9.9 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-48486?
How severe is CVE-2026-48486?
How do I fix CVE-2026-48486?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-4847A vulnerability was found in dameng100 muucmf 1.9.5.20260309…4.3
- CVE-2026-4848A vulnerability was determined in dameng100 muucmf 1.9.5.202…4.3
- CVE-2026-48480The netty incubator codec.bhttp is a java language binary ht…6.6
- CVE-2026-48482GLPI is a free asset and IT management software package. Fro…9.4
- CVE-2026-48483TypeBot is a chatbot builder tool. Prior to version 3.17.0, …5.4
- CVE-2026-48485Quest Bot is an opensource Discord Bot. Prior to version 1.1…2.1
- CVE-2026-48487Zeroconf is a pure Python implementation of multicast DNS se…5.3
- CVE-2026-48488phpMyFAQ is an open source FAQ web application. Prior to ver…2.7
- CVE-2026-48489Symfony is a PHP framework for web and console applications …7.5
- CVE-2026-4849A vulnerability was identified in code-projects Simple Laund…6.1
- CVE-2026-48490ArduinoCore-avr contains the source code and configuration f…6.9
- CVE-2026-48491Traefik is an HTTP reverse proxy and load balancer. From 3.7…10
Are you affected by CVE-2026-48486?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST