CVE-2026-24783 affects the soroban-fixed-point-math library for Soroban smart contracts in versions 1.3.0 and 1.4.0. The vulnerability is in the mulDiv(x, y, z) function which incorrectly handles cases where both the intermediate product x*y and divisor z are negative. The logic flaw causes incorrect rounding direction when both values are negative, affecting fixed_div_floor and fixed_div_ceil functions. The error impacts all signed FixedPoint and SorobanFixedPoint implementations including i64, i128, and I256. Patches are available in versions 1.3.1 and 1.4.1 with no known workarounds.