CVE-2026-62333

{
  "etk_id": "ETK-2026-3114",
  "cve_id": "CVE-2026-62333",
  "display_id": "CVE-2026-62333",
  "ghsa_id": "GHSA-396x-v8w4-9x82",
  "euvd_id": "EUVD-2026-114442",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Memory Merkle proof validation flaw in OpenVM",
  "summary": "Affected OpenVM releases mishandle certain MemoryMerkleAir expansion rows, allowing a malicious prover to produce proofs with an altered committed memory root. This affects proof soundness for deployments that use persistent memory across continuation segment boundaries and accept proofs from an attacker-controlled prover.",
  "mitigation": "Upgrade openvm to version 1.7.0, 2.0.0-rc.3, or 2.1.0-preview, as appropriate for the release line. Until upgraded, do not trust proofs from untrusted provers when persistent memory is in use.",
  "vendor": "openvm-org",
  "product": "openvm",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 1.7.0"
      ],
      "ecosystem": "rust",
      "fixed_versions": [],
      "package_name": "openvm",
      "purl": "pkg:cargo/openvm"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 1.7.0"
      ],
      "ecosystem": "rust",
      "fixed_versions": [],
      "package_name": "openvm-sdk",
      "purl": "pkg:cargo/openvm-sdk"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 1.7.0"
      ],
      "ecosystem": "rust",
      "fixed_versions": [],
      "package_name": "openvm-circuit",
      "purl": "pkg:cargo/openvm-circuit"
    }
  ],
  "cwes": [
    20
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 35.05955771666667,
  "t0_at": "2026-10-30T20:08:48.566000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-30T20:08:48.566000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-30T20:08:48.566000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62333"
    }
  }
}