Arithmetic overflow occurs in soroban-sdk's Bytes::slice, Vec::slice, and Prng::gen_range (u64) methods for versions up to 25.0.1, 23.5.1, and 25.0.2. The overflow can be triggered when user‑controlled or computed range bounds are passed, causing the library to use incorrect data ranges or generate random numbers from an unintended range. In Rust releases that compile without overflow checks, the overflow silently wraps, potentially corrupting contract state. This weakness is identified as integer overflow (CWE‑190) and can lead to data corruption or unintended behavior within Soroban contracts.

Affected systems are those built on Stellar's rs‑soroban‑sdk library. The vulnerability exists in SDK releases up to and including 25.0.1, 23.5.1, and 25.0.2. Contracts or tools that depend on those specific versions are at risk unless they have been upgraded or otherwise mitigated. The latest published releases (for example 25.0.2 and 23.5.1) contain a patch that replaces bare arithmetic with checked operations to trap overflows regardless of the overflow‑checks setting.

CVSS score of 5.3 indicates a medium‑level severity, and the EPSS score is below 1 %, suggesting low probability of exploitation. The vulnerability is not listed as a known exploited vulnerability by CISA. The attack vector depends on whether the contract author compiles with `overflow-checks = false`; an attacker that can influence the range bounds passed to the vulnerable methods could cause silent data or state manipulation, but success requires code‑level control or a malicious contract author. Enabling `overflow-checks = true` or using the latest patched SDK mitigates the risk by forcing panics or corrected arithmetic. Therefore, the overall risk to existing contracts is moderate, with the main concern being potential state corruption if unchecked arithmetic is used.