CVE-2026-54496
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
In the halo2_gadgets library up to 0.5.0 and related Zcash components (zebrad, orchard, zcash_primitives, zcashd), there is a vulnerability due to missing a copy constraint for the base point in the variable-base scalar multiplication gadget. This allows a malicious prover to generate a valid proof for an Orchard Action with an under-constrained base point, bypassing the diversified-address-integrity check.
Risk Assessment
An attacker can forge a cryptographic proof, compromising transaction integrity in the Zcash network. The organization may lose trust in the correctness of processed transactions and, in extreme cases, funds could be stolen.
Recommendation
Immediately update all Zcash components to versions: zebrad 5.0.0, halo2_gadgets 0.5.0, orchard 0.14.0, zcash_primitives 0.28.0, and zcashd 6.20.0.
Original NVD description (English source)
ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad 5.0.0, halo2_gadgets 0.5.0, orchard 0.14.0, zcash_primitives 0.28.0, and zcashd 6.20.0, the variable-base scalar multiplication gadget in halo2_gadgets/src/ecc/chip/mul/incomplete.rs used assign_advice() for the base point without a copy constraint tying it to the actual base, allowing a malicious prover to produce a valid proof for an Orchard Action with an under-constrained base point and bypass the diversified-address-integrity check that binds pk_d, g_d, ivk, the nullifier (nf), and the spend validating key (ak) to the note being spent. This issue is fixed in zebrad 5.0.0, halo2_gadgets 0.5.0, orchard 0.14.0, zcash_primitives 0.28.0, and zcashd 6.20.0.