CVE-2026-62334High· 8.7▾ TwilightOpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, `OpenVmHalo2Verifier.verify` constructs raw proof calldata from user-contr…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 47.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.5%
OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, OpenVmHalo2Verifier.verify constructs raw proof calldata from user-controlled proofData, performs a staticcall to address(this), and treats a successful call as proof acceptance. If the first four proof bytes match another external selector exposed by the wrapper, dispatch can invoke a successful non-verifier function instead of the generated Halo2 fallback verifier. Applications using the generated Solidity wrapper can consequently accept arbitrary app commitments and public values without checking the proof suffix, accumulator, app commitments or public values. This issue is fixed in versions 1.7.0, 2.0.0-rc.3 and 2.1.0-preview.
openvm < 1.7.0openvm >= 2.0.0-alpha, < 2.0.0-rc.3openvm >= 2.1.0-dev.0, < 2.1.0-previewRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-62333High· 8.7OpenVM: MemoryMerkleAir allows below-leaf rows to alter memory roots
CVE-2026-62335Medium· 6.9OpenVM's OpenVmHalo2Verifier accepts non-canonical app commitments
CVE-2026-123588High· 7.5Hickory DNS Recursive Resolver Denial of Service via Cached Empty Connection Pool
CVE-2025-3359Medium· 6.2Gnuplot: segmentation fault via io_str_init_static_internal function
CVE-2026-48186NoneImproper handling of messages before AS security activation can cause unexpected behavior
CVE-2026-69006NoneInsufficient validation of length fields in the GNSS firmware loader can result in kernel‑memory corruption.