StringM::from_str in the Stellar XDR library does not enforce the declared maximum length when constructing a StringM value. If an input string exceeds the allowed size, the function erroneously returns a successful result and produces a StringM that violates its length invariant. This flaw can allow callers to create malformed XDR structures that may bypass downstream validation, serialization, or other logic that assumes the invariant holds, potentially leading to logical inconsistencies, denial of service, or other integrity problems.

The vulnerability affects the Stellar rs‑stellar-xdr library and CLI up to and including version 25.0.0. Systems that use this library to parse or construct XDR messages—such as Stellar network nodes, client libraries, or any application that depends on rs‑stellar-xdr—are impacted.

The CVSS score is 4.0, reflecting moderate severity. The EPSS score is below 1 % and the issue is not listed in the CISA KEV catalog, indicating a low likelihood of active exploitation at present. However, because the flaw enables the creation of oversized StringM objects that can trick downstream code, an attacker with the ability to supply crafted input—whether locally or remotely via an application that parses untrusted XDR—could exploit the weakness. The attack would involve feeding an oversized string to StringM::<N>::from_str or str::parse, which the affected library accepts without error. Since the flaw lies in the library itself and does not require additional conditions, its exploitability remains contingent on whether the vulnerable code path is invoked.