CVE-2026-61694Low· 3.7▾ TwilightPoC availablego-xrpl is a Go implementation of the XRP Ledger protocol. In versions through the June 18, 2026 revision identified by the advisory, `ParseMPTAmountBinary` in `internal/ledger/state/ripple_state.go` converts the eight-byte MPT magnitude…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 20.4 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
Last analysed / modified upstream
Exploit / PoC code exists
go-xrpl is a Go implementation of the XRP Ledger protocol. In versions through the June 18, 2026 revision identified by the advisory, ParseMPTAmountBinary in internal/ledger/state/ripple_state.go converts the eight-byte MPT magnitude using num.Int64() without checking that it fits in 63 bits. A positive magnitude of at least 2^63 silently wraps into a negative amount without an error. ParseEscrow passes 33-byte sfAmount fields to the parser and stores MPTRaw() in EscrowData.MPTAmount, causing incorrect downstream calculations and divergence from rippled's interpretation of the same escrow entry. Independently, readMPTAmount in internal/tx/ledgerfields/decode_stream.go accepts over-limit magnitudes and surfaces large decimal strings without enforcing the maximum signed 64-bit value. The public codec in codec/binarycodec/types/amount.go already rejects these values, leaving the internal decoders inconsistent with that safe path. A source fix is available in commit 9dbd3935ed6c54f0232f2291edf9c012a0900dd5.
go-xrpl <= 0.0.0-20260618134614-cb77d640ee26Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-49112Critical· 9.8Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
CVE-2026-102834High· 7.5JavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infinite-Loop DoS
CVE-2022-25315Critical· 9.8In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.
CVE-2022-25314High· 7.5In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString.
CVE-2022-23990High· 7.5Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.
CVE-2022-23852Critical· 9.8Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.