Nimiq core-rs-albatross EUVD-2026-25054

Attacker must possess valid low-privilege validator credentials in a Nimiq Albatross network (PR:L) - this requires staking NIM tokens and completing validator registration, limiting the threat to registered network participants or compromised validator operators rather than anonymous external attackers. Target node must run core-rs-albatross version prior to 1.3.0. No special network configurations, disabled security features, or user interaction required (AC:L/UI:N). The vulnerability exists in default skip block proof verification logic executed during normal consensus operation. Exploitation is limited to consensus-layer attacks rather than traditional RCE/data exfiltration - attacker cannot directly compromise nodes but can manipulate blockchain state by forging validator participation, which may enable double-spending or denial of finality depending on attacker's position in the validator set.

CVSS 9.6 (Critical) indicates network-accessible attack requiring low-privilege validator credentials (PR:L) with no complexity barriers and changed scope affecting consensus integrity and availability - appropriate for a consensus forgery vulnerability. The changed scope (S:C) reflects that compromising one validator's consensus participation can impact the entire blockchain network's integrity. Attack complexity is genuinely low (AC:L) since exploit requires only crafting BitSet indices at known 65536-byte intervals. However, real-world risk is moderated by PR:L requirement: attacker must control at least one registered validator with staking credentials in the Nimiq network, limiting this to insider threats or compromised validator operators rather than anonymous internet attackers. No EPSS score available to assess widespread exploitation probability. Not listed in CISA KEV, and GitHub advisory (GHSA-6973-8887-87ff) contains no indication of active exploitation - this appears to be a responsibly disclosed vulnerability patched before public exploitation. Primary concern is targeted attacks against Nimiq-based networks by malicious validators rather than opportunistic mass exploitation. Patch availability in v1.3.0 significantly reduces ongoing risk for operators who upgrade.

A malicious validator operator with staking credentials in a Nimiq Albatross network crafts a fraudulent skip block proof claiming validator participation from multiple slots. They construct a MultiSignature.signers BitSet containing indices {5, 65541, 131077, 196613} - all resolving to slot 5 (mod 65536) after u16 casting. The SkipBlockProof.verify function counts len()=4 for quorum verification, meeting the 2f+1 threshold, but during BLS signature aggregation all four indices collapse to validator slot 5. The attacker provides their own BLS signature for slot 5 multiplied by factor 4, which verifies successfully. The network accepts a skip block signed by only one real validator, violating Byzantine fault tolerance assumptions and enabling chain manipulation or double-spend attacks.