soroban-sdk has overflow in Bytes::slice, Vec::slice, GenRange::gen_range for u64

Description

soroban-sdk is a Rust SDK for Soroban contracts. Arithmetic overflow can be triggered in the `Bytes::slice`, `Vec::slice`, and `Prng::gen_range` (for `u64`) methods in the `soroban-sdk` in versions up to and including `25.0.1`, `23.5.1`, and `25.0.2`. Contracts that pass user-controlled or computed range bounds to `Bytes::slice`, `Vec::slice`, or `Prng::gen_range` may silently operate on incorrect data ranges or generate random numbers from an unintended range, potentially resulting in corrupted contract state. Note that the best practice when using the `soroban-sdk` and building Soroban contracts is to always enable `overflow-checks = true`. The `stellar contract init` tool that prepares the boiler plate for a Soroban contract, as well as all examples and docs, encourage the use of configuring `overflow-checks = true` on `release` profiles so that these arithmetic operations fail rather than silently wrap. Contracts are only impacted if they use `overflow-checks = false` either explicitly or implicitly. It is anticipated the majority of contracts could not be impacted because the best practice encouraged by tooling is to enable `overflow-checks`. The fix available in `25.0.1`, `23.5.1`, and `25.0.2` replaces bare arithmetic with `checked_add` / `checked_sub`, ensuring overflow traps regardless of the `overflow-checks` profile setting. As a workaround, contract workspaces can be configured with a profile available in the GitHub Securtity Advisory to enable overflow checks on the arithmetic operations. This is the best practice when developing Soroban contracts, and the default if using the contract boilerplate generated using `stellar contract init`. Alternatively, contracts can validate range bounds before passing them to `slice` or `gen_range` to ensure the conversions cannot overflow.

Timeline

Scores

EPSS (exploitation in 30 days)

0.38% · top 67% of all CVEs (7 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.3.

Weakness

• CWE-190: Integer Overflow or Wraparound (opens in a new tab)All about CWE-190 and its CVEs

Affected products

• stellar · rs-soroban-sdk

  • affected < 22.0.9
  • affected >= 23.0.0, < 23.5.1
  • affected >= 25.0.0, < 25.0.2

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• crates.iosoroban-sdkGHSA-96xm-fv9w-pf3f (opens in a new tab)

References (8)

• https://github.com/stellar/rs-soroban-sdk/security/advisories/GHSA-96xm-fv9w-pf3f (opens in a new tab)x_refsource_CONFIRM
• https://github.com/stellar/rs-soroban-sdk/pull/1703 (opens in a new tab)x_refsource_MISC
• https://github.com/stellar/rs-soroban-sdk/commit/3890521426d71bb4d892b21f5a283a1e836cfa38 (opens in a new tab)x_refsource_MISC
• https://github.com/stellar/rs-soroban-sdk/commit/59fcef437260ed4da42d1efb357137a5c166c02e (opens in a new tab)x_refsource_MISC
• https://github.com/stellar/rs-soroban-sdk/commit/c2757c6d774dbb28b34a0b77ffe282e59f0f8462 (opens in a new tab)x_refsource_MISC
• https://github.com/stellar/rs-soroban-sdk/releases/tag/v22.0.9 (opens in a new tab)x_refsource_MISC
• https://github.com/stellar/rs-soroban-sdk/releases/tag/v23.5.1 (opens in a new tab)x_refsource_MISC
• https://github.com/stellar/rs-soroban-sdk/releases/tag/v25.0.2 (opens in a new tab)x_refsource_MISC

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-96xm-fv9w-pf3f (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-24889](https://trackcve.app/badge/CVE-2026-24889.svg)](https://trackcve.app/cve/CVE-2026-24889)

Record last updated 29 Jan 2026, 18:00 UTC.