CVE-2026-33471

OVERVIEW CVE-2026-33471 is a critical signature verification bypass vulnerability in nimiq-block versions prior to 1.3.0, a Rust library providing block primitives for Nimiq's blockchain implementation. The flaw exists in the SkipBlockProof::verify function, which miscalculates quorum validation by casting indices from a BitSet using usize-to-u16 conversion without proper bounds checking. This allows attackers to forge skip block proofs with insufficient legitimate signers. SEVERITY The vulnerability carries a CVSS v3.1 score of 9.6 (CRITICAL) with a network-accessible attack vector, low complexity, and only low privileges required. The impact is severe: a malicious validator with far fewer than the required 2f+1 real signer slots can successfully spoof valid block proofs by reusing a single BLS signature multiple times through index collision exploitation. This enables integrity compromise and potential denial of service across the blockchain network, with no confidentiality impact. EXPLOITATION STATUS There is no evidence of active exploitation in the wild, and this vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog. Community attention remains minimal as indicated by low EPSS probability (0.000250000). However, the patch has been available since version 1.3.0 was released, and organizations running Nimiq should prioritize upgrading to mitigate this high-impact consensus-layer vulnerability.