Read the docs
TI-2026-83377 Aliases CVE-2026-62337

Point-at-infinity handling flaw in SNARK Verifier Halo 2 aggregation

Priority LOW 36CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

SNARK Verifier before 0.2.5 mishandles proof points encoded as the point at infinity in its Halo 2 aggregation circuit (CWE-20). A prover-controlled proof point encoded as (0, 0) can enter the final aggregation sum through a scalar-one shortcut and affect the MSM or accumulator computation. Exploitation depends on the surrounding aggregation and final-decider checks; the advisory does not establish that invalid proofs are universally accepted.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Description from the CNA

SNARK Verifier is a generic (S)NARK verifier. Prior to 0.2.5, the Halo 2 aggregation circuit can mishandle proof points encoded as the point at infinity. `EcPointLoader::multi_scalar_multiplication` places a `Value::Assigned(_)` base paired with `Value::Constant(ONE)` into its unscaled variable-base list and passes it directly to `sum_with_const`. The default shim delegates to halo2-lib `EccChip::sum`, whose incomplete affine addition assumes nonidentity input points. A prover-controlled proof point encoded as `(0, 0)` can therefore enter the final aggregation sum through the scalar-one shortcut and affect the MSM or accumulator computation. Practical exploitability depends on the surrounding aggregation and final-decider checks; the advisory does not establish universal acceptance of invalid proofs. This issue is fixed in version 0.2.5.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00301 23rd percentileScored 2026-11-07
Fix Fixed snark-verifier (axiom-crypto): 0.2.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
axiom-cryptosnark-verifierbefore 0.2.50.2.5Patch availableCNA
  • snark-verifier Vendoraxiom-crypto Affected before 0.2.5 Fixed in 0.2.5 Patch available CNA

Remediation

Upgrade axiom-crypto snark-verifier to version 0.2.5, which fixes the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

  • Fix · CNA snark-verifier (axiom-crypto) Fixed in 0.2.5

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-62337
  2. 2026-11-01 Priority changed: MEDIUM → LOW
  3. 2026-11-02 CISA SSVC decision points changed

References

  • TI-2026-83349 Noncanonical accumulator limb decoding in SNARK Verifier CVSS 4.0MEDIUM 6.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences