Live › vulnerability › CVE-2026-61618
SNARK Verifier is a Rust/EVM library for checking zero-knowledge proofs; before 0.2.5 it decodes KZG accumulator limbs without enforcing canonical bounds. A crafted proof encoding can make the native verifier panic, and the EVM path accepts noncanonical encodings at the verifier boundary.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 20:25 UTC. All times on this page are UTC.
Teams that depend on the snark-verifier crate to verify proofs, especially those verifying proofs supplied by outside parties or running the EVM loader. The sources say standard SDK aggregation circuits constrain accumulator limbs before this boundary, which limits practical exploitability. Teams that only verify their own trusted proofs are at much lower risk.
No product ranges from the sources yet.
snark-verifier version in Cargo.lock or your dependency manifest; anything below 0.2.5 is affected.snark-verifier crate that verify untrusted proofs or run the EVM loader.snark-verifier 0.2.5Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SNARK Verifier is a generic (S)NARK verifier. Prior to 0.2.5, KZG accumulator public-instance limbs are decoded without consistently enforcing canonical limb bounds before elliptic-curve coordinate reconstruction. PlonkProof::read selects scalars using accumulator_indices and passes them to AccumulatorEncoding::from_repr. For the EVM loader, LimbsEncoding::from_repr forwards them to EvmLoader::ec_point_from_limbs in snark-verifier/src/loader/evm/loader.rs, where shl and add reconstruct coordinates before validate_ec_point checks the resulting affine point rather than the original limb bounds. The related native path in snark-verifier/src/pcs/kzg/accumulator.rs can reach assertion- or unwrap-based decoding and panic instead of returning a verification error. This allows noncanonical encodings at the verifier boundary and can crash the native verifier. Standard SDK aggregation circuits are expected to constrain accumulator limbs before this boundary, which limits practical exploitability. This issue is fixed in version 0.2.5.
This page as .md · .json · in your agent: get_signal("CVE-2026-61618")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.