A flaw in the LightBlockchain::rebranch() method omits updates to critical state when a fork chain’s tip is a macro block. As a result, the node retains an outdated macro head, election head, and validator set. When subsequent block pushes happen, the node attempts to verify new blocks against the stale predecessor, causing consistent verification failures. This stalls the light client's ability to process new blocks and effectively disables it from synchronizing with the network, leading to a denial of service situation.

The vulnerability affects the Nimiq core-rs-albatross implementation. Clients running any version prior to 1.4.0 are at risk, as the issue was resolved in the 1.4.0 release.

The CVSS score of 6.5 indicates moderate severity. EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation yet. Likely, the attack involves an adversary providing a fork chain whose tip is a macro block, which the light client will then rebranch onto. While the exact method of inducing a rebranch is not disclosed, the description implies that a malicious node could attempt to propagate such a chain. The consequence would be service disruption until the client is patched or restarted.