A flaw in the Nimiq Rust implementation’s skip block verification permits a malicious validator to craft a SkipBlockProof with out‑of‑range signer indices spaced by 65536. The routine first uses the full BitSet length to calculate the required quorum, then casts each index to a 16‑bit value for slot lookup. Because the high‑order bits are discarded, the inflated quorum count collapses onto the same in‑range u16 slot during signature aggregation. As a result, a validator with fewer than the 2f+1 unique signatures required for consensus can satisfy the quorum by repeating a single BLS signature, effectively bypassing the intended block validation.

The vulnerability impacts the nimiq-block component of the Nimiq core‑rs Albatross implementation. All releases prior to version 1.3.0 are affected.

The CVSS score of 9.6 indicates critical severity, and even though an EPSS score is unavailable, the high impact and lack of mitigation expose systems to immediate exploitation. The vulnerability is not listed in CISA KEV, but the impact on a decentralized ledger makes it a high‑risk threat if unpatched. The attack vector is administrative: an attacker must control a validator node capable of broadcasting a crafted SkipBlockProof. Knowledge of the index spacing mechanism is required, but the vulnerability can be replicated with the supplied commit or release information.