{"id":"CVE-2026-61618","kind":"vulnerability","aliases":["CVE-2026-61618"],"related":[],"title":"SNARK Verifier: noncanonical KZG limbs can crash or bypass the verifier","description":"SNARK Verifier is a generic (S)NARK verifier. Prior to 0.2.5, KZG accumulator public-instance limbs are decoded without consistently enforcing canonical limb bounds before elliptic-curve coordinate reconstruction. `PlonkProof::read` selects scalars using `accumulator_indices` and passes them to `AccumulatorEncoding::from_repr`. For the EVM loader, `LimbsEncoding::from_repr` forwards them to `EvmLoader::ec_point_from_limbs` in `snark-verifier/src/loader/evm/loader.rs`, where `shl` and `add` reconstruct coordinates before `validate_ec_point` checks the resulting affine point rather than the original limb bounds. The related native path in `snark-verifier/src/pcs/kzg/accumulator.rs` can reach assertion- or unwrap-based decoding and panic instead of returning a verification error. This allows noncanonical encodings at the verifier boundary and can crash the native verifier. Standard SDK aggregation circuits are expected to constrain accumulator limbs before this boundary, which limits practical exploitability. This issue is fixed in version 0.2.5.","summary":"SNARK Verifier is a Rust/EVM library for checking zero-knowledge proofs; before 0.2.5 it decodes KZG accumulator limbs without enforcing canonical bounds. A crafted proof encoding can make the native verifier panic, and the EVM path accepts noncanonical encodings at the verifier boundary.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["evm","package","rust","snark-verifier","zero-knowledge"],"not_affected_if":["sdk-aggregation-circuits","trusted-proofs-only","version-0.2.5-or-later"],"how_to_check":"- Check the `snark-verifier` version in `Cargo.lock` or your dependency manifest; anything below `0.2.5` is affected.\n- Look for uses of the `snark-verifier` crate that verify untrusted proofs or run the EVM loader.","fix":"- `snark-verifier` `0.2.5`","status":"open","published_at":"2026-10-30T20:17:10+00:00","first_seen_at":"2026-10-30T20:25:38+00:00","triaged_at":"2026-10-30T20:26:45+00:00","updated_at":"2026-10-30T20:26:45+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T20:26:45Z","model":"claude-haiku-5-5","output":{"fix":"- `snark-verifier` `0.2.5`","reach":"network","title":"SNARK Verifier: noncanonical KZG limbs can crash or bypass the verifier","impact":"medium","summary":"SNARK Verifier is a Rust/EVM library for checking zero-knowledge proofs; before 0.2.5 it decodes KZG accumulator limbs without enforcing canonical bounds. A crafted proof encoding can make the native verifier panic, and the EVM path accepts noncanonical encodings at the verifier boundary.","audience":"developers","category":"package","nicknames":[],"who_cares":["rust","zero-knowledge","evm","snark-verifier"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"verifier crashes on crafted proof; noncanonical encodings accepted","analyst_note":"","how_to_check":"- Check the `snark-verifier` version in `Cargo.lock` or your dependency manifest; anything below `0.2.5` is affected.\n- Look for uses of the `snark-verifier` crate that verify untrusted proofs or run the EVM loader.","plain_action":"","needs_analyst":false,"not_affected_if":["trusted-proofs-only","sdk-aggregation-circuits","version-0.2.5-or-later"],"who_is_affected":"Teams that depend on the snark-verifier crate to verify proofs, especially those verifying proofs supplied by outside parties or running the EVM loader. The sources say standard SDK aggregation circuits constrain accumulator limbs before this boundary, which limits practical exploitability. Teams that only verify their own trusted proofs are at much lower risk.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00075,"input_tokens":4410,"output_tokens":618,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-61618':14A,17A '/src/loader/evm/loader.rs':135C '/src/pcs/kzg/accumulator.rs':165C '0.2.5':40B,81C,219C 'accept':64B 'accumul':44B,83C,107C,204C 'accumulatorencod':113C 'add':139C 'affin':149C 'aggreg':198C 'allow':183C 'assert':168C 'base':172C 'bound':49B,95C,156C 'boundari':70B,189C,208C 'bypass':9A 'canon':48B,93C 'check':34B,146C 'circuit':199C 'consist':91C 'constrain':203C 'coordin':100C,141C 'craft':51B 'crash':7A,192C 'curv':99C 'cve':12A,15A 'decod':42B,89C,173C 'ec':127C,144C 'ellipt':98C 'elliptic-curv':97C 'encod':53B,66B,185C 'enforc':47B,92C 'error':181C 'evm':18B,62B,118C 'evmload':126C 'expect':201C 'exploit':212C 'fix':216C 'forward':123C 'generic':75C 'indic':108C 'instanc':86C 'instead':176C 'issu':214C 'knowledg':26B,37B 'kzg':4A,43B,82C 'librari':32B 'limb':5A,45B,87C,94C,130C,155C,205C 'limbsencod':120C 'limit':210C 'loader':119C 'make':55B 'nark':77C 'nativ':57B,159C,194C 'noncanon':3A,65B,184C 'origin':154C 'packag':19B 'panic':59B,175C 'pass':110C 'path':63B,160C 'plonkproof':102C 'point':128C,145C,150C 'practic':211C 'prior':79C 'proof':38B,52B 'public':85C 'public-inst':84C 'rather':151C 'reach':167C 'read':103C 'reconstruct':101C,140C 'relat':158C 'repr':115C,122C 'result':148C 'return':178C 'rust':20B 'rust/evm':31B 'scalar':105C 'sdk':197C 'select':104C 'shl':137C 'snark':1A,22B,27B,71C,133C,163C 'snark-verifi':21B,132C,162C 'standard':196C 'unwrap':171C 'unwrap-bas':170C 'use':106C 'valid':143C 'verif':180C 'verifi':2A,11A,23B,28B,58B,69B,72C,78C,134C,164C,188C,195C 'version':218C 'without':46B,90C 'zero':25B,36B 'zero-knowledg':24B,35B","nicknames":[],"mitigations":[],"who_affected":"Teams that depend on the snark-verifier crate to verify proofs, especially those verifying proofs supplied by outside parties or running the EVM loader. The sources say standard SDK aggregation circuits constrain accumulator limbs before this boundary, which limits practical exploitability. Teams that only verify their own trusted proofs are at much lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T20:17:10+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-61618","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61618","severity":null,"published_at":"2026-10-30T20:17:10+00:00","modified_at":"2026-10-30T20:17:10+00:00","first_seen_at":"2026-10-30T20:25:38+00:00","fetched_at":"2026-10-30T20:25:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}