Variable-Base Scalar Multiplication Vulnerability in ZEBRA by Zcash Foundation

CVE-2026-54496

What is CVE-2026-54496?

The ZEBRA implementation prior to the specified versions contains a security vulnerability in its handling of variable-base scalar multiplication. The flaw occurs in the halo2_gadgets component, which allows a malicious actor to generate valid proof for Orchard Actions using an under-constrained base point, thereby bypassing critical integrity checks. This compromise enables potential exploitation of the transactional privacy mechanisms, urging users to upgrade to the latest versions for enhanced security guarantees.

References