CVE-2026-48486

Signum Node, the node software for the HDD-mined Signum cryptocurrency, contains an integer overflow (CWE-190) in BlockServiceImpl.applyBlock() that allows a miner to receive an arbitrarily inflated block reward. The flaw was introduced when the SMART_FEES hardfork (around block 1,029,000) enabled fee cash-back and burn accounting without overflow protection, and it is triggered by crafting a block with a negative totalFeeCashBackNqt value. A malicious miner gains coins beyond the protocol-intended reward, corrupting reward accounting on nodes that accept the block, diluting the supply, and creating a risk of consensus divergence among nodes. Anyone running Signum Node prior to version 3.9.9 on a chain past the hardfork is affected, which in practice means most active nodes. There is no known public proof-of-concept, no confirmed in-the-wild exploitation, and the EPSS score is low at 0.2% (10th percentile); the issue is not in CISA KEV.

What to do: Upgrade all Signum Node instances to version 3.9.9 immediately, prioritizing nodes operated by miners who can produce blocks. Until upgraded, monitor the chain for blocks with anomalous (inflated) rewards and be prepared to re-sync or follow any chain reorganization coordinated by the project. Because the flaw stems from mining-crafted blocks rather than remote network access to nodes, no additional network mitigation substitutes for the patch.