CVE-2026-54496: Zcash Orchard Action circuit soundness vulnerability in halo2_gadgets

CVE-2026-54496 · Severity: critical · CVSS 9.3 · Published 2026-07-17

A critical security flaw was identified in the Zcash Orchard pool, which is used for private cryptocurrency transactions. This vulnerability could allow a malicious actor to spend the same digital funds multiple times (double-spending) or potentially steal funds from other users if they have access to certain viewing keys. While the total supply of Zcash is protected by existing safety mechanisms, this issue could have led to significant financial loss and inflation within the private Orchard pool.

Technologies: zebrad (crates.io), Zcash Foundation Zebra. Vendors: crates.io, Zcash Foundation.

Quick answers

Is CVE-2026-54496 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54496 being exploited in the wild.
How severe is CVE-2026-54496?
Critical severity, with a CVSS score of 9.3, published 17 July 2026.
Which products and versions are affected?
halo2_gadgets (crates.io) < 0.5.0, SEMVER:introduced=0,fixed=0.5.0; orchard (crates.io) < 0.14.0, SEMVER:introduced=0,fixed=0.14.0; zcash_primitives (crates.io) < 0.28.0, SEMVER:introduced=0,fixed=0.28.0; zebrad (crates.io) <= 4.5.1, SEMVER:introduced=0,fixed=5.0.0; and 3 more.
Is there a fix for CVE-2026-54496?
Yes. halo2_gadgets (crates.io): upgrade to 0.5.0 or later; orchard (crates.io): upgrade to 0.14.0 or later; zcash_primitives (crates.io): upgrade to 0.28.0 or later; zebrad (crates.io): upgrade to 5.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54496 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54496?
Check whether you run halo2_gadgets (crates.io), orchard (crates.io), zcash_primitives (crates.io) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • halo2_gadgets (crates.io): upgrade to 0.5.0 or later
    cargo update -p halo2_gadgets
  • orchard (crates.io): upgrade to 0.14.0 or later
    cargo update -p orchard
  • zcash_primitives (crates.io): upgrade to 0.28.0 or later
    cargo update -p zcash_primitives
  • zebrad (crates.io): upgrade to 5.0.0 or later
    cargo update -p zebrad

Technical details

A soundness vulnerability exists in the variable-base scalar multiplication gadget within halo2_gadgets/src/ecc/chip/mul/incomplete.rs. The root cause is the use of assign_advice() for the base point without a corresponding copy constraint to anchor it to the actual base. This allows a malicious prover to provide an under-constrained base point to satisfy the diversified-address-integrity check (pk_d = [ivk] g_d) with arbitrary values. Consequently, an attacker can generate multiple valid nullifiers for a single note, enabling double-spending, or forge spend authorizations. The issue is fixed in zebrad 5.0.0, halo2_gadgets 0.5.0, orchard 0.14.0, zcash_primitives 0.28.0, and zcashd 6.20.0 via the NU6.2 network upgrade.

Affected products

  • ZcashFoundation zebra < 5.0.0
  • zcash halo2_gadgets < 0.5.0
  • zcash orchard < 0.14.0
  • zcash librustzcash (zcash_primitives) < 0.28.0
  • zcash zcashd < 6.20.0

Identifiers

  • CVE-2026-54496
  • GHSA-ww9q-8r59-xv46

Timeline

  • 2022-05-31: other: Vulnerability introduced with NU5 upgrade
  • 2026-06-02: patched: Fixes released in various component versions
  • 2026-06-15: advisory: Security advisory published by Zcash Foundation
  • 2026-07-17: disclosed: CVE-2026-54496 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.