Core Rs Albatross EUVD-2026-22061

Nimiq core-rs-albatross implements the Albatross consensus algorithm, a Proof-of-Stake blockchain protocol written in Rust. The vulnerability resides in the Tendermint proposal message handling logic within ProposalSender::send. The code performs a bounds check on the signer field against validators.num_validators() using a greater-than comparison (signer > num_validators) rather than greater-than-or-equal (signer >= num_validators). When an attacker sets signer exactly equal to num_validators(), the validation passes incorrectly, allowing execution to proceed to validators.get_validator_by_slot_band(signer). Since valid validator indices are zero-based (0 to num_validators-1), this causes an out-of-bounds array access. Rust's panic-on-out-of-bounds behavior terminates the validator process immediately, before the code reaches any cryptographic signature verification that would reject the malicious message. This is classified as CWE-125 (Out-of-bounds Read), though the immediate impact is availability disruption rather than information disclosure, as the panic occurs before data exfiltration. The affected product is identified by CPE cpe:2.3:a:nimiq:core-rs-albatross:*:*:*:*:*:*:*:*, covering all versions prior to the 1.3.0 fix.