Nimiq Albatross CVE-2026-46540

The vulnerability requires that the attacker's fork chain tip be a macro block - either a checkpoint (batch boundary) or an election block (epoch boundary). The most severe outcome (permanent chain stall) occurs specifically when the rebranch tip is an election block, because stale current_validators corrupts every subsequent verify_validators() call. The target must be running the LightBlockchain implementation (light client mode); full nodes using Blockchain::rebranch() are not affected by this missing state-update path. No authentication is required (PR:N in CVSS vector). No special user interaction is needed. The attack is limited to light clients reachable on the Nimiq P2P network that can be induced to rebranch - either via natural fork resolution or by an adversarial peer presenting a crafted superior chain. Exploitation is constrained to the rebranch code path; light clients that never encounter a fork with a macro-block tip are not affected in practice.

The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) reflects a network-reachable, unauthenticated attack requiring no user interaction and low complexity, but with only partial integrity and availability impact. The limited impact scores are appropriate: the vulnerability affects only LightBlockchain consumers (light clients), not full nodes running Blockchain::rebranch(). The practical impact on targeted light clients, however, is severe - a successful rebranch to an election block produces a permanent chain stall with no self-recovery, effectively a complete denial of chain progression for that client. The CVSS scope of U (unchanged) is consistent: only the light client's own state is corrupted, not other systems. EPSS data was not provided in the input and cannot be inferred. No CISA KEV listing. The NVD-supplied tag 'Information Disclosure' appears inconsistent with the described impact (integrity corruption and availability loss); this may reflect a tagging error or a secondary effect not elaborated in the advisory - analysts should treat the primary impact as integrity and availability, not confidentiality. The fix is present in a merged public PR, meaning the triggering conditions are fully visible to any researcher reading the diff, which slightly elevates the likelihood of a targeted proof-of-concept being constructed.

An attacker with the ability to influence the blocks seen by a target light client - for example, by operating a peer node on the Nimiq P2P network - constructs or waits for a natural fork whose diverging tip is an election macro block. When the attacker's chain accumulates sufficient work to be preferred, the target light client calls rebranch(), adopts the fork, but retains its old current_validators. Every subsequent block pushed to the client then fails verify_validators() against the now-incorrect validator set, and the client's chain permanently halts. The exact triggering conditions are fully documented in the regression tests added in PR #3706, lowering the barrier to constructing a targeted proof-of-concept.