Read the docs
TI-2022-07239 Aliases CVE-2022-23066GHSA-9qmm-4mfr-r3wj

Solana rBPF - Incorrect Calculation in sdiv instruction

Priority MEDIUM 44CWE-682Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

In Solana rBPF versions 0.2.26 and 0.2.27 are affected by Incorrect Calculation which is caused by improper implementation of sdiv instruction. This can lead to the wrong execution path, resulting in huge loss in specific cases. For example, the result of a sdiv instruction may decide whether to transfer tokens or not. The vulnerability affects both integrity and may cause serious availability problems.

Why it matters now

EPSS 0.02516 84th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed solana_rbpf (crates.io): 0.2.28

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
solana-labsrbpf0.2.26 and later; up to 0.2.27—No fix listedCNA
—solana_rbpf (crates.io)0.2.26 to before 0.2.280.2.28Patch availableGHSA-9qmm-4mfr-r3wj
  • rbpf Vendorsolana-labs Affected 0.2.26 and later; up to 0.2.27 Fixed in — No fix listed CNA
  • solana_rbpf (crates.io) Vendor— Affected 0.2.26 to before 0.2.28 Fixed in 0.2.28 Patch available GHSA-9qmm-4mfr-r3wj

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:solana:rbpf:0.2.26:*:*:*:*:*:*:*0.2.26VulnerableSolana
cpe:2.3:a:solana:rbpf:0.2.27:*:*:*:*:*:*:*0.2.27VulnerableSolana
  • cpe:2.3:a:solana:rbpf:0.2.26:*:*:*:*:*:*:* Versions 0.2.26 Vulnerable ·Solana
  • cpe:2.3:a:solana:rbpf:0.2.27:*:*:*:*:*:*:* Versions 0.2.27 Vulnerable ·Solana

Remediation

  • Fix · GHSA-9qmm-4mfr-r3wj solana_rbpf (crates.io) Fixed in 0.2.28 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-23066
  2. 2026-10-03 Alias added: GHSA-9qmm-4mfr-r3wj

References

Exploit 2

Patch 1

Advisory 1

Other 1

  • TI-2024-19999 Handling untrusted input can result in a crash, leading to loss of availability / denial of service CVSS 3.1HIGH 7.5
  • TI-2024-36250 @solana/web3.js modified package published to npm, containing malware that exfiltrates private key material CVSS 4.0HIGH 8.3
  • TI-2021-21061 From version 0.2.14 to 0.2.16 for Solana rBPF, function "relocate" in the file src/elf.rs… CVSS 3.1HIGH 7.5
  • TI-2022-13297 Solana solana_rbpf before 0.2.29 has an addition integer overflow via invalid ELF program… CVSS 3.1HIGH 7.5
  • TI-2022-16344 Weakness in Transfer Validation Logic in @solana/pay CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences