---
id: CVE-2026-61618
title: 'SNARK Verifier: noncanonical accumulator limb decoding'
summary: >-
  SNARK Verifier is a generic (S)NARK verifier. Prior to 0.2.5, KZG accumulator
  public-instance limbs are decoded without consistently enforcing canonical
  limb bounds before elliptic-curve coordinate reconstruction.
  `PlonkProof::read` sele…
severity: medium
cvss: 6.9
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-20
vendor: axiom-crypto
product: snark-verifier
affected:
  - snark-verifier < 0.2.5
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-05T02:36:49.094897Z'
published: '2026-10-30'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T02:37:02.204Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-61618'
references:
  - url: >-
      https://github.com/axiom-crypto/snark-verifier/security/advisories/GHSA-265x-v3qf-ff6p
    label: >-
      https://github.com/axiom-crypto/snark-verifier/security/advisories/GHSA-265x-v3qf-ff6p
  - url: >-
      https://github.com/axiom-crypto/snark-verifier/commit/d6aaf66d4706f5317cf61d5dbe00c14e7fbdbb70
    label: >-
      https://github.com/axiom-crypto/snark-verifier/commit/d6aaf66d4706f5317cf61d5dbe00c14e7fbdbb70
  - url: 'https://github.com/axiom-crypto/snark-verifier/releases/tag/v0.2.5'
    label: 'https://github.com/axiom-crypto/snark-verifier/releases/tag/v0.2.5'
tags:
  - cve.org
epss: 0.00371
epssPercentile: 0.31253
ingestedAt: '2026-11-05T21:36:00.695Z'
---

## Overview

SNARK Verifier is a generic (S)NARK verifier. Prior to 0.2.5, KZG accumulator public-instance limbs are decoded without consistently enforcing canonical limb bounds before elliptic-curve coordinate reconstruction. `PlonkProof::read` selects scalars using `accumulator_indices` and passes them to `AccumulatorEncoding::from_repr`. For the EVM loader, `LimbsEncoding::from_repr` forwards them to `EvmLoader::ec_point_from_limbs` in `snark-verifier/src/loader/evm/loader.rs`, where `shl` and `add` reconstruct coordinates before `validate_ec_point` checks the resulting affine point rather than the original limb bounds. The related native path in `snark-verifier/src/pcs/kzg/accumulator.rs` can reach assertion- or unwrap-based decoding and panic instead of returning a verification error. This allows noncanonical encodings at the verifier boundary and can crash the native verifier. Standard SDK aggregation circuits are expected to constrain accumulator limbs before this boundary, which limits practical exploitability. This issue is fixed in version 0.2.5.

## Affected

- `snark-verifier < 0.2.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.