-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

0xCERT Security Advisory 0xCERT-2026-0197
============================================================

Advisory-ID:  0xCERT-2026-0197
Severity:     High
Published:    2026-05-13T15:31:49.000Z
Updated:      2026-10-08T22:47:30.935Z
Chains:       Solana
URL:          https://www.0xcert.com/advisory/0xCERT-2026-0197

Title: Anchor: Program<'info, System> is not properly validated

Summary
- -------
Anchor: Program<'info, System> is not properly validated. An logic error causes anchor programs to accept any program id when requiring the system program id, causing false assumptions resulting in potential arbitrary cpi in programs that invoke system program instructions.

Details
- -------
Summary
An logic error causes anchor programs to accept any program id when requiring the system program id, causing false assumptions resulting in potential arbitrary cpi in programs that invoke system program instructions.

Affected
- - anchor-lang (rust) >= 1.0.0, < 1.0.2 — fixed in 1.0.2

Severity
High, as rated by the upstream advisory.

Recommended actions
- - Upgrade anchor-lang to 1.0.2 or later

Source & attribution
This 0xCERT advisory summarises GHSA-c6rc-8jpp-2fgc / CVE-2026-45137 from the GitHub Advisory Database, credited upstream to Matthias1590: https://github.com/advisories/GHSA-c6rc-8jpp-2fgc. Details may change; refer to the original source for the authoritative record.

References
- ----------
- - https://github.com/advisories/GHSA-c6rc-8jpp-2fgc
- - CVE-2026-45137
- - https://github.com/solana-foundation/anchor/security/advisories/GHSA-c6rc-8jpp-2fgc
- - https://github.com/solana-foundation/anchor/releases/tag/v1.0.2
- - https://github.com/otter-sec/anchor/security/advisories/GHSA-c6rc-8jpp-2fgc
- - https://rustsec.org/advisories/RUSTSEC-2026-0144.html
- - https://nvd.nist.gov/vuln/detail/CVE-2026-45137

Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc
Fingerprint: 5F94 3ED1 1E50 CF31 2128  C493 CCC7 D9EC 9415 723D

-----BEGIN PGP SIGNATURE-----

wrsEARYKAG0FgmrIRikJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp
b25zLm9wZW5wZ3Bqcy5vcmc1OmdD26Q8EWh4Fp74tS4FmKB1zUnPkNDq+ImV
DZbdtBYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAABtHAD+O+c33YBNNS6aJip7
gxk7NBCWMQiYP2UKUUz08D+5Fb0BAKk+rQOG7/iCx5wvyNnmr+gOPX3e1ONo
jloWO4NiKIAO
=OBIy
-----END PGP SIGNATURE-----