CVE-2026-62334

OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, OpenVmHalo2Verifier.verify constructs raw proof calldata from user-controlled proofData, performs a staticcall to addressthis, and...

CVE-2026-62333

OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, MemoryMerkleAir does not forbid Merkle expansion rows at parentheight = 0 or below while expanddirection != 0. A malicious prover can...

CVE-2026-62335

OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, OpenVmHalo2Verifier.verify accepts appExeCommit and appVmCommit as bytes32 values without checking that either is less than the BN254...

EUVD-2026-114442

OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, MemoryMerkleAir does not forbid Merkle expansion rows at parentheight = 0 or below while expanddirection != 0. A malicious prover can...

CVE-2026-62333

The OpenVM zkVM framework is vulnerable to a flaw in the MemoryMerkleAir component (versions before 1.7.0 in the 1.x line, and affected 2.0 and 2.1 prereleases). The root cause is the failure to forbid Merkle expansion rows at parent_height $\le$ 0 when expand_direction is non-zero. This allows a...

CVE-2026-62333 OpenVM: MemoryMerkleAir allows below-leaf rows to alter memory roots

OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, MemoryMerkleAir does not forbid Merkle expansion rows at parentheight = 0 or below while expanddirection != 0. A malicious prover can...

CVE-2026-62333 OpenVM: MemoryMerkleAir allows below-leaf rows to alter memory roots

OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, MemoryMerkleAir does not forbid Merkle expansion rows at parentheight = 0 or below while expanddirection != 0. A malicious prover can...

CVE-2026-62334 OpenVM's OpenVmHalo2Verifier self-call can bypass proof verification

OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, OpenVmHalo2Verifier.verify constructs raw proof calldata from user-controlled proofData, performs a staticcall to addressthis, and...

EUVD-2026-114441

OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, OpenVmHalo2Verifier.verify constructs raw proof calldata from user-controlled proofData, performs a staticcall to addressthis, and...

CVE-2026-62334

The OpenVM zkVM framework contains a vulnerability in the OpenVmHalo2Verifier.verify function affecting versions before 1.7.0 (1.x line) and specific 2.0 and 2.1 prereleases. The root cause is that the verifier constructs raw proof calldata from user-controlled proofData and performs a staticcall...

EUVD-2026-114438

OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, OpenVmHalo2Verifier.verify accepts appExeCommit and appVmCommit as bytes32 values without checking that either is less than the BN254...

CVE-2026-62335 OpenVM's OpenVmHalo2Verifier accepts non-canonical app commitments

OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, OpenVmHalo2Verifier.verify accepts appExeCommit and appVmCommit as bytes32 values without checking that either is less than the BN254...

CVE-2026-62335

The OpenVM zkVM framework is vulnerable in versions before 1.7.0 (1.x line) and affected 2.0 and 2.1 prereleases. The OpenVmHalo2Verifier.verify function fails to validate that appExeCommit and appVmCommit values are less than the BN254 scalar field modulus. This allows callers to provide non-can...

CVE-2026-62335 OpenVM's OpenVmHalo2Verifier accepts non-canonical app commitments

OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, OpenVmHalo2Verifier.verify accepts appExeCommit and appVmCommit as bytes32 values without checking that either is less than the BN254...

PT-2026-134191

OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, OpenVmHalo2Verifier.verify constructs raw proof calldata from user-controlled proofData, performs a staticcall to addressthis, and...

CVE-2026-62334: openvm-org openvm: OpenVM is a performant and modular zkVM framework built for customization and extensibility

OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, OpenVmHalo2Verifier.verify constructs raw proof calldata from user-controlled proofData, performs a staticcall to addressthis, and...

CVE-2026-62335: openvm-org openvm: OpenVM is a performant and modular zkVM framework built for customization and extensibility

OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, OpenVmHalo2Verifier.verify accepts appExeCommit and appVmCommit as bytes32 values without checking that either is less than the BN254...

PT-2026-134190

OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, MemoryMerkleAir does not forbid Merkle expansion rows at parent height = 0 or below while expand direction != 0. A malicious prover ca...

PT-2026-134192

OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, OpenVmHalo2Verifier.verify accepts appExeCommit and appVmCommit as bytes32 values without checking that either is less than the BN254...

CVE-2026-62333: openvm-org openvm: OpenVM is a performant and modular zkVM framework built for customization and extensibility

OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, MemoryMerkleAir does not forbid Merkle expansion rows at parentheight = 0 or below while expanddirection != 0. A malicious prover can...