PT-2026-134190
CVE-2026-62333
·
Published
2026-10-30
·
Updated
2026-10-30
Description by
CVSS 4.0
8.7
HighMetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
OpenVM versions prior to 1.7.0
OpenVM versions prior to 2.0.0-rc.3
OpenVM versions prior to 2.1.0-preview
Description
In the
MemoryMerkleAir component, the system fails to forbid Merkle expansion rows when parent height is 0 or below and expand direction is not 0. This allows a malicious prover to fabricate a subtree below a memory leaf and swap digests within that subtree, altering the committed memory root without performing a legitimate memory operation. Since the memory Merkle root binds the VM memory state across continuation segment boundaries, this flaw compromises the soundness of proofs using persistent memory.Recommendations
Update to version 1.7.0.
Update to version 2.0.0-rc.3.
Update to version 2.1.0-preview.
Found an issue in the description? Have something to add? Feel free to write us 👾