{"cve":"CVE-2026-62334","nvd":{"published":"2026-10-30T20:17:12.493","modified":"2026-10-30T20:17:12.493","status":"Received","description":"OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, `OpenVmHalo2Verifier.verify` constructs raw proof calldata from user-controlled `proofData`, performs a `staticcall` to `address(this)`, and treats a successful call as proof acceptance. If the first four proof bytes match another external selector exposed by the wrapper, dispatch can invoke a successful non-verifier function instead of the generated Halo2 fallback verifier. Applications using the generated Solidity wrapper can consequently accept arbitrary app commitments and public values without checking the proof suffix, accumulator, app commitments or public values. This issue is fixed in versions 1.7.0, 2.0.0-rc.3 and 2.1.0-preview.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","score":8.7},"cvss_v3":null,"cwes":["CWE-754"],"references":["https://github.com/openvm-org/openvm/blob/v2.0.0-alpha/crates/sdk/contracts/template/OpenVmHalo2Verifier.sol","https://github.com/openvm-org/openvm/blob/v2.0.0-beta.2/crates/sdk/contracts/template/OpenVmHalo2Verifier.sol","https://github.com/openvm-org/openvm/blob/v2.1.0-dev.0/crates/sdk/contracts/template/OpenVmHalo2Verifier.sol","https://github.com/openvm-org/openvm/commit/751bdb1725254c3268782ddf8df89f19035666e3","https://github.com/openvm-org/openvm/pull/151"],"products":[],"source":"nvd","synced_at":"2026-10-30T20:41:38.734504606+00:00"},"epss":null,"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}