---
id: "CVE-2026-61618"
kind: "vulnerability"
aliases: ["CVE-2026-61618"]
title: "SNARK Verifier: noncanonical KZG limbs can crash or bypass the verifier"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["evm", "package", "rust", "snark-verifier", "zero-knowledge"]
not_affected_if: ["sdk-aggregation-circuits", "trusted-proofs-only", "version-0.2.5-or-later"]
published_at: "2026-10-30T20:17:10+00:00"
first_seen_at: "2026-10-30T20:25:38+00:00"
updated_at: "2026-10-30T20:26:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61618", "first_seen_at": "2026-10-30T20:25:38+00:00"}]
---

# SNARK Verifier: noncanonical KZG limbs can crash or bypass the verifier

SNARK Verifier is a Rust/EVM library for checking zero-knowledge proofs; before 0.2.5 it decodes KZG accumulator limbs without enforcing canonical bounds. A crafted proof encoding can make the native verifier panic, and the EVM path accepts noncanonical encodings at the verifier boundary.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the `snark-verifier` version in `Cargo.lock` or your dependency manifest; anything below `0.2.5` is affected.
- Look for uses of the `snark-verifier` crate that verify untrusted proofs or run the EVM loader.

## Fix

- `snark-verifier` `0.2.5`

## Timeline

- 2026-10-30T20:25:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-61618

## From the sources

SNARK Verifier is a generic (S)NARK verifier. Prior to 0.2.5, KZG accumulator public-instance limbs are decoded without consistently enforcing canonical limb bounds before elliptic-curve coordinate reconstruction. `PlonkProof::read` selects scalars using `accumulator_indices` and passes them to `AccumulatorEncoding::from_repr`. For the EVM loader, `LimbsEncoding::from_repr` forwards them to `EvmLoader::ec_point_from_limbs` in `snark-verifier/src/loader/evm/loader.rs`, where `shl` and `add` reconstruct coordinates before `validate_ec_point` checks the resulting affine point rather than the original limb bounds. The related native path in `snark-verifier/src/pcs/kzg/accumulator.rs` can reach assertion- or unwrap-based decoding and panic instead of returning a verification error. This allows noncanonical encodings at the verifier boundary and can crash the native verifier. Standard SDK aggregation circuits are expected to constrain accumulator limbs before this boundary, which limits practical exploitability. This issue is fixed in version 0.2.5.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_