CVE-2026-61618

MediumCVSS 6.9

Published: 30/10/2026(UTC)Updated: 02/11/2026(UTC)Translated: 30/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.37%

31th percentile - higher than 31% of all known CVEs

Summary

SNARK Verifier is a generic (S)NARK verifier. Prior to 0.2.5, KZG accumulator public-instance limbs are decoded without consistently enforcing canonical limb bounds before elliptic-curve coordinate reconstruction. PlonkProof::read selects scalars using accumulator_indices and passes them to AccumulatorEncoding::from_repr. For the EVM loader, LimbsEncoding::from_repr forwards them to EvmLoader::ec_point_from_limbs in snark-verifier/src/loader/evm/loader.rs, where shl and add reconstruct coordinates before validate_ec_point checks the resulting affine point rather than the original limb bounds. The related native path in snark-verifier/src/pcs/kzg/accumulator.rs can reach assertion- or unwrap-based decoding and panic instead of returning a verification error. This allows noncanonical encodings at the verifier boundary and can crash the native verifier. Standard SDK aggregation circuits are expected to constrain accumulator limbs before this boundary, which limits practical exploitability. This issue is fixed in version 0.2.5.

Risk Assessment

May allow non-canonical encodings at the verifier boundary and cause the native verifier to crash (denial of service).

Recommendation

Update SNARK Verifier to version 0.2.5 or later.

Other vulnerabilities in SNARK Verifier

CVE-2026-62337Medium
SNARK Verifier is a generic (S)NARK verifier. Prior to 0.2.5, the Halo 2 aggregation circuit can mishandle proof points encoded as the point at infinity. EcPointLoader::multi_scalar_multiplication places a Value::Assigned(_) base paired with Value::Constant(ONE) into its unscaled variable-base list and passes it directly to sum_with_const. The default shim delegates to halo2-lib EccChip::sum, whose incomplete affine addition assumes nonidentity input points. A prover-controlled proof point encoded as (0, 0) can therefore enter the final aggregation sum through the scalar-one shortcut and affect the MSM or accumulator computation. Practical exploitability depends on the surrounding aggregation and final-decider checks; the advisory does not establish universal acceptance of invalid proofs. This issue is fixed in version 0.2.5.

Original NVD description (English source)

SNARK Verifier is a generic (S)NARK verifier. Prior to 0.2.5, KZG accumulator public-instance limbs are decoded without consistently enforcing canonical limb bounds before elliptic-curve coordinate reconstruction. `PlonkProof::read` selects scalars using `accumulator_indices` and passes them to `AccumulatorEncoding::from_repr`. For the EVM loader, `LimbsEncoding::from_repr` forwards them to `EvmLoader::ec_point_from_limbs` in `snark-verifier/src/loader/evm/loader.rs`, where `shl` and `add` reconstruct coordinates before `validate_ec_point` checks the resulting affine point rather than the original limb bounds. The related native path in `snark-verifier/src/pcs/kzg/accumulator.rs` can reach assertion- or unwrap-based decoding and panic instead of returning a verification error. This allows noncanonical encodings at the verifier boundary and can crash the native verifier. Standard SDK aggregation circuits are expected to constrain accumulator limbs before this boundary, which limits practical exploitability. This issue is fixed in version 0.2.5.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS