CVE-2026-62333 in OpenVM
Summary
by MITRE • 10/30/2026
OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, `MemoryMerkleAir` does not forbid Merkle expansion rows at `parent_height` = 0 or below while `expand_direction` != 0. A malicious prover can fabricate a subtree below a memory leaf and swap digests inside that subtree to change the committed memory root without a corresponding memory operation. The fraudulent rows still balance against the Merkle and compression buses and require no memory-bus operation for the changed leaf. Because the memory Merkle root binds VM memory state across continuation segment boundaries, this affects the soundness of OpenVM proofs using persistent memory. This issue is fixed in versions 1.7.0, 2.0.0-rc.3 and 2.1.0-preview.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified within the OpenVM zkVM framework represents a critical flaw in the integrity verification logic of its MemoryMerkleAir constraint system. This zero-knowledge virtual machine is designed for high performance and modularity, relying heavily on Merkle trees to maintain an immutable record of memory state across computational segments. The core issue arises from insufficient validation constraints regarding how Merkle tree expansions are processed during proof generation. Specifically, the logic fails to properly restrict expansion operations when the parent height is zero or negative while a non-zero expand direction is specified. This oversight creates a gap in the cryptographic binding between the committed memory root and the actual state of the virtual machine's memory, allowing for sophisticated manipulation that bypasses standard verification checks.
From a technical perspective, this flaw enables a malicious prover to fabricate subtrees beneath existing memory leaves without triggering any corresponding memory bus operations. In normal operation, changes to memory must be explicitly recorded through specific bus interactions that are verified by the zero-knowledge proof system. However, due to the missing constraint at parent height zero or below, an attacker can alter digests within a fabricated subtree and swap them in a way that maintains mathematical balance against both the Merkle constraints and the compression buses. This means the fraudulent rows appear valid within the algebraic structure of the proof, even though they do not correspond to any legitimate memory modification initiated by the program logic. The ability to change the committed memory root without a corresponding operation effectively breaks the soundness guarantee for proofs that rely on persistent memory states across continuation segment boundaries.
The operational impact of this vulnerability is severe, particularly in environments where OpenVM is used to verify computations involving long-term or shared state. Since the MemoryMerkleAir component binds the VM's memory state across different execution segments, compromising its integrity allows an attacker to present a proof that appears valid but reflects a manipulated reality. This undermines trust in any application relying on these proofs for security decisions, such as decentralized finance protocols, secure multi-party computation setups, or audit trails where data immutability is paramount. An adversary could potentially hide malicious state changes or fabricate transaction histories by exploiting this gap, leading to potential financial loss or system compromise depending on the specific use case of the OpenVM implementation.
This vulnerability aligns with CWE-20 Improper Input Validation and CWE-367 Time-of-check Time-of-use (TOCTOU) race conditions in logic flow, as it involves a failure to properly validate structural constraints during state transitions. In terms of MITRE ATT&CK for AI/ML systems or general software exploitation techniques, this relates to integrity violations where an attacker manipulates data inputs to bypass security controls, specifically falling under the category of exploiting trust relationships within cryptographic proofs. The lack of strict boundary checks on Merkle tree expansion parameters allows for a form of proof forgery that circumvents the intended zero-knowledge guarantees regarding memory consistency.
To mitigate this risk, it is imperative to upgrade OpenVM to version 1.7.0 or later in the 1.x line, as well as versions 2.0.0-rc.3 and 2.1.0-preview for newer releases. These updates include corrected constraint logic that properly forbids Merkle expansion rows at invalid parent heights unless specific conditions are met, thereby closing the gap exploited by malicious provers. Organizations currently running affected versions should immediately patch their infrastructure to restore the soundness of memory-bound proofs and prevent potential exploitation through fabricated subtree manipulations.