axiom-crypto snark-verifier up to 0.2.4 KZG Accumulator loader.rs PlonkProof::read input validation

Summaryinfo

A vulnerability, which was classified as critical, has been found in axiom-crypto snark-verifier up to 0.2.4. The impacted element is the function PlonkProof::read of the file snark-verifier/src/loader/evm/loader.rs of the component KZG Accumulator. Performing a manipulation results in input validation. This vulnerability is identified as CVE-2026-61618. The attack can be initiated remotely. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in axiom-crypto snark-verifier up to 0.2.4. This affects the function PlonkProof::read of the file snark-verifier/src/loader/evm/loader.rs of the component KZG Accumulator. The manipulation with an unknown input leads to a input validation vulnerability. CWE is classifying the issue as CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. This is going to have an impact on integrity, and availability. The summary by CVE is:

SNARK Verifier is a generic (S)NARK verifier. Prior to 0.2.5, KZG accumulator public-instance limbs are decoded without consistently enforcing canonical limb bounds before elliptic-curve coordinate reconstruction. `PlonkProof::read` selects scalars using `accumulator_indices` and passes them to `AccumulatorEncoding::from_repr`. For the EVM loader, `LimbsEncoding::from_repr` forwards them to `EvmLoader::ec_point_from_limbs` in `snark-verifier/src/loader/evm/loader.rs`, where `shl` and `add` reconstruct coordinates before `validate_ec_point` checks the resulting affine point rather than the original limb bounds. The related native path in `snark-verifier/src/pcs/kzg/accumulator.rs` can reach assertion- or unwrap-based decoding and panic instead of returning a verification error. This allows noncanonical encodings at the verifier boundary and can crash the native verifier. Standard SDK aggregation circuits are expected to constrain accumulator limbs before this boundary, which limits practical exploitability. This issue is fixed in version 0.2.5.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-61618 since 07/10/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available.

Upgrading to version 0.2.5 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• axiom-crypto

Name

• snark-verifier

Version

• 0.2.0
• 0.2.1
• 0.2.2
• 0.2.3
• 0.2.4

Website

• Product: https://github.com/axiom-crypto/snark-verifier/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion