openvm-org OpenVM prior 1.7.0/2.0.0-rc.3/2.1.0-preview Halo2 Verifier OpenVmHalo2Verifier.verify proofData input validation

Summaryinfo

A vulnerability marked as critical has been reported in openvm-org OpenVM. The affected element is the function OpenVmHalo2Verifier.verify of the component Halo2 Verifier. This manipulation of the argument proofData causes input validation. This vulnerability is handled as CVE-2026-62334. The attack can be initiated remotely. There is not any exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in openvm-org OpenVM. Affected by this vulnerability is the function OpenVmHalo2Verifier.verify of the component Halo2 Verifier. The manipulation of the argument proofData with an unknown input leads to a input validation vulnerability. The CWE definition for the vulnerability is CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. As an impact it is known to affect integrity, and availability. The summary by CVE is:

OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, `OpenVmHalo2Verifier.verify` constructs raw proof calldata from user-controlled `proofData`, performs a `staticcall` to `address(this)`, and treats a successful call as proof acceptance. If the first four proof bytes match another external selector exposed by the wrapper, dispatch can invoke a successful non-verifier function instead of the generated Halo2 fallback verifier. Applications using the generated Solidity wrapper can consequently accept arbitrary app commitments and public values without checking the proof suffix, accumulator, app commitments or public values. This issue is fixed in versions 1.7.0, 2.0.0-rc.3 and 2.1.0-preview.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-62334 since 07/13/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 1.7.0, 2.0.0-rc.3 or 2.1.0-preview eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• openvm-org

Name

• OpenVM

Website

• Product: https://github.com/openvm-org/openvm/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion