CVE-2026-62333 Details
Description
OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, `MemoryMerkleAir` does not forbid Merkle expansion rows at `parent_height` = 0 or below while `expand_direction` != 0. A malicious prover can fabricate a subtree below a memory leaf and swap digests inside that subtree to change the committed memory root without a corresponding memory operation. The fraudulent rows still balance against the Merkle and compression buses and require no memory-bus operation for the changed leaf. Because the memory Merkle root binds VM memory state across continuation segment boundaries, this affects the soundness of OpenVM proofs using persistent memory. This issue is fixed in versions 1.7.0, 2.0.0-rc.3 and 2.1.0-preview.
A vulnerability exists in the OpenVM zkVM framework, specifically in versions prior to 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases. The issue arises in the 'MemoryMerkleAir' component, which fails to restrict Merkle expansion rows at 'parent_height' of 0 or below when 'expand_direction' is not 0. This oversight enables a malicious prover to create a fabricated subtree beneath a memory leaf and manipulate digests within that subtree, altering the committed memory root without a corresponding memory operation. The fraudulent rows still align with the Merkle and compression buses, evading detection by the memory-bus operation for the modified leaf. Since the memory Merkle root connects VM memory state across continuation segment boundaries, this vulnerability undermines the integrity of OpenVM proofs that rely on persistent memory.
Users are advised to upgrade to OpenVM versions 1.7.0, 2.0.0-rc.3, or 2.1.0-preview, all of which include the necessary fix. Instructions for downloading these versions are available on the OpenVM GitHub Releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Nov 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-20 | Improper Input Validation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| OpenVM | < 1.7.0 (semver) |
CPE
Remediation
| |
| OpenVM Circuit | < 1.7.0 (semver) |
CPE
Remediation
| |
| OpenVM SDK | < 1.7.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | [email protected] |