CVE-2022-23066

CRITICAL 9.1CVE-2022-23066 · Published 09/05/2022 · updated 17/06/2026

In short

CVE-2022-23066 is a CRITICAL (CVSS 9.1) vulnerability affecting rbpf (solana).
Chance of exploitation in the next 30 days (EPSS): 2.5%, higher than 84.9% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
rbpf solana	`= 0.2.26= 0.2.27`	No fix yet

Description

In Solana rBPF versions 0.2.26 and 0.2.27 are affected by Incorrect Calculation which is caused by improper implementation of sdiv instruction. This can lead to the wrong execution path, resulting in huge loss in specific cases. For example, the result of a sdiv instruction may decide whether to transfer tokens or not. The vulnerability affects both integrity and may cause serious availability problems.

References

blocksecteam.medium.com/how-a-critical-bug-in-solana-network-was-detected-and-timely-patched-a701870e1324 · Exploit
solana-labs/rbpf commit e61e045 · Patch
whitesourcesoftware.com/vulnerability-database/CVE-2022-23066 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free