Memory Manipulation Vulnerability in OpenVM zkVM Framework
CVE-2026-62333
What is CVE-2026-62333?
The OpenVM zkVM framework is susceptible to a memory manipulation issue that arises from improper handling of Merkle expansion rows, specifically when 'parent_height' is set to 0 or less while 'expand_direction' is not equal to zero. This flaw allows an attacker to create a fraudulent subtree beneath a memory leaf, enabling them to interchange digests within that subtree. Consequently, this manipulates the committed memory root without triggering a memory operation. This vulnerability has serious implications for the integrity of OpenVM proofs which utilize persistent memory, as it jeopardizes the soundness of the VM memory state across continuation segment boundaries. The issue is effectively resolved in the updated versions 1.7.0, 2.0.0-rc.3, and 2.1.0-preview.
Affected Version(s)
openvm < 1.7.0 < 1.7.0
openvm >= 2.0.0-alpha, < 2.0.0-rc.3 < 2.0.0-alpha, 2.0.0-rc.3
openvm >= 2.1.0-dev.0, < 2.1.0-preview < 2.1.0-dev.0, 2.1.0-preview