Vulnerability in OpenVM zkVM Framework Affects User-Proof Validations
CVE-2026-62334
8.7HIGH
What is CVE-2026-62334?
The OpenVM zkVM framework has a significant flaw in its proof verification process. Versions prior to 1.7.0 and certain 2.0 and 2.1 pre-releases incorrectly construct proof calldata from user-controlled data. This defect enables a successful static call to potentially execute unauthorized functions rather than the intended verifier function. As a result, applications may mistakenly validate arbitrary app commitments and public values without adequate checks, leading to severe security risks. The issue has been addressed in versions 1.7.0, 2.0.0-rc.3, and 2.1.0-preview.
Affected Version(s)
openvm < 1.7.0 < 1.7.0
openvm >= 2.0.0-alpha, < 2.0.0-rc.3 < 2.0.0-alpha, 2.0.0-rc.3
openvm >= 2.1.0-dev.0, < 2.1.0-preview < 2.1.0-dev.0, 2.1.0-preview