# CVE-2026-54496: Zcash Orchard Action circuit soundness vulnerability in halo2_gadgets

Source: https://junglewise.ai/threats/cve-2026-54496-zcash-orchard-action-circuit-soundness-vulnerability-in-halo2  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-17. Updated: 2026-07-17  
License: CC BY 4.0 with a link back

CVE-2026-54496 · Severity: critical · CVSS 9.3 · Published 2026-07-17

A critical security flaw was identified in the Zcash Orchard pool, which is used for private cryptocurrency transactions. This vulnerability could allow a malicious actor to spend the same digital funds multiple times (double-spending) or potentially steal funds from other users if they have access to certain viewing keys. While the total supply of Zcash is protected by existing safety mechanisms, this issue could have led to significant financial loss and inflation within the private Orchard pool.

Technologies: [zebrad (crates.io)](https://junglewise.ai/threats/technologies/zebrad), [Zcash Foundation Zebra](https://junglewise.ai/threats/technologies/zebra). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io), [Zcash Foundation](https://junglewise.ai/threats/vendors/zcash-foundation).

## Quick answers

**Is CVE-2026-54496 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54496 being exploited in the wild.

**How severe is CVE-2026-54496?** Critical severity, with a CVSS score of 9.3, published 17 July 2026.

**Which products and versions are affected?** halo2_gadgets (crates.io) < 0.5.0, SEMVER:introduced=0,fixed=0.5.0; orchard (crates.io) < 0.14.0, SEMVER:introduced=0,fixed=0.14.0; zcash_primitives (crates.io) < 0.28.0, SEMVER:introduced=0,fixed=0.28.0; zebrad (crates.io) <= 4.5.1, SEMVER:introduced=0,fixed=5.0.0; and 3 more.

**Is there a fix for CVE-2026-54496?** Yes. halo2_gadgets (crates.io): upgrade to 0.5.0 or later; orchard (crates.io): upgrade to 0.14.0 or later; zcash_primitives (crates.io): upgrade to 0.28.0 or later; zebrad (crates.io): upgrade to 5.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54496 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54496?** Check whether you run halo2_gadgets (crates.io), orchard (crates.io), zcash_primitives (crates.io) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- halo2_gadgets (crates.io): upgrade to 0.5.0 or later

  ```sh
  cargo update -p halo2_gadgets
  ```

- orchard (crates.io): upgrade to 0.14.0 or later

  ```sh
  cargo update -p orchard
  ```

- zcash_primitives (crates.io): upgrade to 0.28.0 or later

  ```sh
  cargo update -p zcash_primitives
  ```

- zebrad (crates.io): upgrade to 5.0.0 or later

  ```sh
  cargo update -p zebrad
  ```


## Technical details

A soundness vulnerability exists in the variable-base scalar multiplication gadget within halo2_gadgets/src/ecc/chip/mul/incomplete.rs. The root cause is the use of assign_advice() for the base point without a corresponding copy constraint to anchor it to the actual base. This allows a malicious prover to provide an under-constrained base point to satisfy the diversified-address-integrity check (pk_d = [ivk] g_d) with arbitrary values. Consequently, an attacker can generate multiple valid nullifiers for a single note, enabling double-spending, or forge spend authorizations. The issue is fixed in zebrad 5.0.0, halo2_gadgets 0.5.0, orchard 0.14.0, zcash_primitives 0.28.0, and zcashd 6.20.0 via the NU6.2 network upgrade.

## Affected products

- ZcashFoundation zebra < 5.0.0
- zcash halo2_gadgets < 0.5.0
- zcash orchard < 0.14.0
- zcash librustzcash (zcash_primitives) < 0.28.0
- zcash zcashd < 6.20.0

## Identifiers

- CVE-2026-54496
- GHSA-ww9q-8r59-xv46

## Timeline

- 2022-05-31: other: Vulnerability introduced with NU5 upgrade
- 2026-06-02: patched: Fixes released in various component versions
- 2026-06-15: advisory: Security advisory published by Zcash Foundation
- 2026-07-17: disclosed: CVE-2026-54496 published

## References

- [https://github.com/ZcashFoundation/zebra/releases/tag/v5.0.0](https://github.com/ZcashFoundation/zebra/releases/tag/v5.0.0)
- [https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-ww9q-8r59-xv46](https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-ww9q-8r59-xv46)
- [https://github.com/zcash/halo2/releases/tag/halo2_gadgets-0.5.0](https://github.com/zcash/halo2/releases/tag/halo2_gadgets-0.5.0)
- [https://github.com/zcash/librustzcash/releases/tag/zcash_primitives-0.28.0](https://github.com/zcash/librustzcash/releases/tag/zcash_primitives-0.28.0)
- [https://github.com/zcash/orchard/releases/tag/0.14.0](https://github.com/zcash/orchard/releases/tag/0.14.0)
- [https://github.com/zcash/zcash/releases/tag/v6.20.0](https://github.com/zcash/zcash/releases/tag/v6.20.0)
- [https://zfnd.org/zebra-4-5-3-and-5-0-0-emergency-soft-fork-and-nu6-2-activation](https://zfnd.org/zebra-4-5-3-and-5-0-0-emergency-soft-fork-and-nu6-2-activation)

## Related threats

- [Zebra incomplete cleanup in checkpoint sync stalls initial sync](https://junglewise.ai/threats/cve-2026-123560-zebra-before-7-0-0-contains-an-incomplete-cleanup-vulnerability)
- [Zebra denial of service via quadratic sighash computation](https://junglewise.ai/threats/cve-2026-123559-zebra-before-7-0-0-contains-an-inefficient-algorithmic)
- [Zcash Foundation Zebra zebrad reachable assertion denial of service](https://junglewise.ai/threats/cve-2026-123557-zcashfoundation-zebra-zebrad-before-7-0-0-contains-a-reachable)
- [Zcash Foundation Zebra protection mechanism failure in mempool lock-time scoring](https://junglewise.ai/threats/cve-2026-123556-zcashfoundation-zebra-from-4-5-0-before-7-0-0-contains-a)
- [Zebra misbehavior scoring bypass via invalid script verification](https://junglewise.ai/threats/cve-2026-123555-zebra-from-2-3-0-before-7-0-0-contains-a-denial-of-service)