CVE-2026-55764

Klever-Go, the Go implementation of the Klever blockchain protocol, prior to version 1.7.19 contains a signed integer overflow (CWE-190) in the semi-fungible token (SFT) add-quantity path. A holder of the mint role can submit a very large positive raw Amount via processSemiFungibleAddQuantity in core/kapp/kda/mint.go, causing SFTAddCirculation's meta.Circulation += amount to wrap negative before the per-nonce MaxSupply comparison, which then passes and credits roughly MaxInt64 units while corrupting the on-chain circulation counter. The practical impact is a bypass of the finite supply cap, allowing near-unlimited token issuance and corrupted token accounting on the chain. Affected parties are operators running Klever-Go nodes older than 1.7.19; the fungible token path is not affected because its MintedValue <= 0 guard detects the overflow. No public proof-of-concept or in-the-wild exploitation is known, EPSS is low (0.3% over 30 days), and the flaw is not in CISA KEV.

What to do: Upgrade all Klever-Go nodes to version 1.7.19 or later and coordinate activation of the FixMarketBuyOverflow consensus flag network-wide, since the fix relies on that activation. Operators holding a mint role on any semi-fungible token should review circulation counters for anomalies indicating a wrapped negative balance. The fungible token path requires no action.