CVE-2026-40323

Katalog CVE

CVSS 7.5 · High EPSS 0,22%

Kerentanan Insufficient Verification of Data Authenticity pada succinct sp1. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

SP1 is a zero‑knowledge virtual machine that proves the correct execution of programs compiled for the RISC-V architecture. In versions 6.0.0 through 6.0.2, a soundness vulnerability in the SP1 V6 recursive shard verifier allows a malicious prover to construct a recursive proof from a shard proof that the native verifier would reject. Version 6.1.0 fixes the issue.

Rincian

Terbit di NVD

18 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-345: Insufficient Verification of Data Authenticity
CWE-354: Improper Validation of Integrity Check Value

EPSS (30 hari)

0,22% peluang dieksploitasi; lebih tinggi dari 11,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/succinctlabs/sp1/security/advisories/GHSA-63x8-x938-vx33 advisory vendor
• https://github.com/succinctlabs/sp1/releases/tag/v6.1.0 release notes