CVE-2026-62333
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
OpenVM before 1.7.0 (and affected 2.0 and 2.1 prereleases) has a vulnerability in MemoryMerkleAir that does not forbid Merkle expansion rows at parent_height = 0 or below when expand_direction != 0. A malicious prover can fabricate a subtree and change the committed memory root without a corresponding memory operation, undermining OpenVM proof soundness.
Risk Assessment
A malicious prover can forge proofs about memory state, undermining trust in the zkVM system.
Recommendation
Update OpenVM to version 1.7.0, 2.0.0-rc.3, or 2.1.0-preview.
Other vulnerabilities in OpenVM
See all- CVE-2026-62335Medium
OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, OpenVmHalo2Verifier.verify accepts appExeCommit and appVmCommit as bytes32 values without checking that either is less than the BN254 scalar field modulus. Although public-value and proof-data lengths are checked, callers can provide non-canonical 256-bit encodings greater than or equal to that modulus at the Solidity wrapper boundary. Applications relying on the wrapper can therefore accept non-canonical app executable and app VM commitments, creating ambiguity between the supplied byte-level values and the field elements used by the verifier. This issue is fixed in versions 1.7.0, 2.0.0-rc.3 and 2.1.0-preview.
- CVE-2026-62334High
OpenVM before 1.7.0 (and affected 2.0 and 2.1 prereleases) has a vulnerability in OpenVmHalo2Verifier.verify where raw calldata from proofData can invoke another external function instead of the verifier, accepting arbitrary app commitments and public values without proof validation.
- CVE-2026-46669High
OpenVM prior to version 1.6.0 contains a vulnerability in the openvm-pairing guest library where the try_honest_pairing_check function does not check that the scaling factor s is in a proper subfield of Fp12. This allows incorrect results to the pairing check.
Original NVD description (English source)
OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, `MemoryMerkleAir` does not forbid Merkle expansion rows at `parent_height` = 0 or below while `expand_direction` != 0. A malicious prover can fabricate a subtree below a memory leaf and swap digests inside that subtree to change the committed memory root without a corresponding memory operation. The fraudulent rows still balance against the Merkle and compression buses and require no memory-bus operation for the changed leaf. Because the memory Merkle root binds VM memory state across continuation segment boundaries, this affects the soundness of OpenVM proofs using persistent memory. This issue is fixed in versions 1.7.0, 2.0.0-rc.3 and 2.1.0-preview.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS