CVE-2026-62337

What it is

SNARK Verifier is a generic (S)NARK verifier. Prior to 0.2.5, the Halo 2 aggregation circuit can mishandle proof points encoded as the point at infinity. `EcPointLoader::multi_scalar_multiplication` places a `Value::Assigned(_)` base paired with `Value::Constant(ONE)` into its unscaled variable-base list and passes it directly to `sum_with_const`. The default shim delegates to halo2-lib `EccChip::sum`, whose incomplete affine addition assumes nonidentity input points. A prover-controlled proof point encoded as `(0, 0)` can therefore enter the final aggregation sum through the scalar-one shortcut and affect the MSM or accumulator computation. Practical exploitability depends on the surrounding aggregation and final-decider checks; the advisory does not establish universal acceptance of invalid proofs. This issue is fixed in version 0.2.5.

At a glance

Exploitability

Can be exploited over the network without logging in. Limited direct impact.

Exploit odds

0.3% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-10-30 20:17 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-11-02 19:35 UTC Last updatedMost recent change to the record

Details

Published

2026-10-30 20:17 UTC

Last modified

2026-11-02 19:35 UTC

Exploit probability

0.3% · EPSS, next 30 days

Weakness

CWE-20 · Improper input validation

Record status

Deferred

Attack profile CVSS 4.0 · 6.9

Attack vector

Network

Complexity

Low

Attack requirements

None

Privileges needed

None

User interaction

None

Confidentiality

None

Integrity

Low

Availability

None