CVE-2026-62334

OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, OpenVmHalo2Verifier.verify constructs raw proof calldata from user-controlled proofData, performs a staticcall to addressthis, and...

CVE-2026-62335

OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, OpenVmHalo2Verifier.verify accepts appExeCommit and appVmCommit as bytes32 values without checking that either is less than the BN254...

EUVD-2026-114441

OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, OpenVmHalo2Verifier.verify constructs raw proof calldata from user-controlled proofData, performs a staticcall to addressthis, and...

CVE-2026-62334

The OpenVM zkVM framework contains a vulnerability in the OpenVmHalo2Verifier.verify function affecting versions before 1.7.0 (1.x line) and specific 2.0 and 2.1 prereleases. The root cause is that the verifier constructs raw proof calldata from user-controlled proofData and performs a staticcall...

EUVD-2026-114438

OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, OpenVmHalo2Verifier.verify accepts appExeCommit and appVmCommit as bytes32 values without checking that either is less than the BN254...

CVE-2026-62335

The OpenVM zkVM framework is vulnerable in versions before 1.7.0 (1.x line) and affected 2.0 and 2.1 prereleases. The OpenVmHalo2Verifier.verify function fails to validate that appExeCommit and appVmCommit values are less than the BN254 scalar field modulus. This allows callers to provide non-can...

CVE-2026-62335: openvm-org openvm: OpenVM is a performant and modular zkVM framework built for customization and extensibility

OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, OpenVmHalo2Verifier.verify accepts appExeCommit and appVmCommit as bytes32 values without checking that either is less than the BN254...

CVE-2026-62334: openvm-org openvm: OpenVM is a performant and modular zkVM framework built for customization and extensibility

OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, OpenVmHalo2Verifier.verify constructs raw proof calldata from user-controlled proofData, performs a staticcall to addressthis, and...