Untrusted peers can send a malicious election macro block that contains an invalid compressed BLS voting key. When the node deserializes the block, it attempts to uncompress the key and panics on invalid data, causing the node to crash. The crash is a local denial of service that brings down the node’s operation but does not expose data or allow code execution.

The vulnerability is present in the nimiq‑primitives library, used by Nimiq’s Rust implementation, in all releases prior to 1.3.0. Users of any earlier version of nimiq‑primitives should identify their build against the library and determine whether it contains the unpatched code path.

The CVSS score of 7.5 indicates a high severity impact, but the EPSS score is < 1% and the vulnerability is not listed in CISA’s KEV catalog, suggesting a low risk of widespread exploitation. The likely attack vector is via the network: a malicious or compromised peer in the peer‑to‑peer network can inject a forged election macro block. Successful exploitation requires connectivity to the target node and the ability to send a crafted block, after which the node will terminate due to the panic.