8.7
HighCVSS 4.0 · from GitHub_M
CVE-2026-46669
`openvm-pairing` pairing check missing proper subfield check on scaling factor
openvm · Improper input validation · CWE-20Affectedopenvm
FixNo fix listed yet.
PublishedJun 10, 20:09 · GitHub_M
ScoredJun 10 · 8.7 · GitHub_M
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:04 UTC
What we know
No known exploitation. CISA KEV, checked 22:04 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
A successful attack can change data. CVSS impact.
Description
OpenVM is a performant and modular zkVM framework built for customization and extensibility. Prior to version 1.6.0, the openvm-pairing guest library's try_honest_pairing_check function invokes Theorem 3 of https://eprint.iacr.org/2024/640.pdf but does not check that the scaling factor s is in a proper subfield of Fp12. This allows incorrect results to the pairing check. This issue has been patched in version 1.6.0.
From GitHub_M
Affected and fixed versions
ProductAffectedFixed inopenvm< 1.6.0–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known