---
id: CVE-2026-61694
title: >-
  go-xrpl: ParseMPTAmountBinary: positive MPT amount silently decoded as
  negative (int64 wrap)
summary: >-
  go-xrpl is a Go implementation of the XRP Ledger protocol. In versions through
  the June 18, 2026 revision identified by the advisory, `ParseMPTAmountBinary`
  in `internal/ledger/state/ripple_state.go` converts the eight-byte MPT
  magnitude…
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-190
vendor: LeJamon
product: go-xrpl
affected:
  - go-xrpl <= 0.0.0-20260618134614-cb77d640ee26
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T17:42:07.230669Z'
exploitAvailable: true
published: '2026-10-30'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T17:58:32.513Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-61694'
references:
  - url: 'https://github.com/LeJamon/go-xrpl/security/advisories/GHSA-j5cw-qr86-mmv7'
    label: 'https://github.com/LeJamon/go-xrpl/security/advisories/GHSA-j5cw-qr86-mmv7'
  - url: 'https://github.com/LeJamon/go-xrpl/pull/1093'
    label: 'https://github.com/LeJamon/go-xrpl/pull/1093'
  - url: >-
      https://github.com/LeJamon/go-xrpl/commit/9dbd3935ed6c54f0232f2291edf9c012a0900dd5
    label: >-
      https://github.com/LeJamon/go-xrpl/commit/9dbd3935ed6c54f0232f2291edf9c012a0900dd5
tags:
  - cve.org
  - exploit-available
epss: 0.00275
epssPercentile: 0.20038
ingestedAt: '2026-11-05T16:24:31.424Z'
---

## Overview

go-xrpl is a Go implementation of the XRP Ledger protocol. In versions through the June 18, 2026 revision identified by the advisory, `ParseMPTAmountBinary` in `internal/ledger/state/ripple_state.go` converts the eight-byte MPT magnitude using `num.Int64()` without checking that it fits in 63 bits. A positive magnitude of at least 2^63 silently wraps into a negative amount without an error. `ParseEscrow` passes 33-byte `sfAmount` fields to the parser and stores `MPTRaw()` in `EscrowData.MPTAmount`, causing incorrect downstream calculations and divergence from rippled's interpretation of the same escrow entry. Independently, `readMPTAmount` in `internal/tx/ledgerfields/decode_stream.go` accepts over-limit magnitudes and surfaces large decimal strings without enforcing the maximum signed 64-bit value. The public codec in codec/binarycodec/types/amount.go already rejects these values, leaving the internal decoders inconsistent with that safe path. A source fix is available in commit 9dbd3935ed6c54f0232f2291edf9c012a0900dd5.

## Affected

- `go-xrpl <= 0.0.0-20260618134614-cb77d640ee26`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.