2026-10-14

This month

Zkvm security 2026 audits bug classes disclosures

Produced by the ZK Security research pipeline. Published only after the automated quality gate. The gate is described in the editorial policy.

This article inventories what six zkVM projects have published about security, as of 14 October 2026. It draws on three kinds of source:

Scope and method

This article inventories what six zkVM projects have published about security, as of 14 October 2026. It draws on three kinds of source:

  • GitHub security advisories (GHSAs) in each project's main repository.
  • Audit reports, either hosted by the auditor or kept in the project's own audits directory.
  • Fix details stated inside those advisories.

It does not cover private disclosures or vendor blog claims. Projects whose repositories carry few primaries are flagged as thin rather than filled in.

Two incidents have their own articles and are not retold here:

  • OpenVM's CVE-2026-46669, the openvm-pairing missing subfield check (GHSA-76mq-v757-53gr).
  • The Aztec Alpha V5 proving-system disclosure.

Fuzzing results across RISC Zero, Nexus and Jolt are covered in our Arguzz article.

Project Published GHSAs (main repo) Published audits found
RISC Zero 6 (2024-07 → 2025-10) Hexens, Veridise, zkSecurity (2023–2025)
SP1 (Succinct) 6 (2024-10 → 2026-10) Cantina, Code4rena, KALOS, rkm0959, Veridise, Zellic
OpenVM 9 (2025-05 → 2026-06) Cantina (v1.x), Nethermind FV, zkSecurity (v2.0)
Jolt 0 none; README says "not been audited"
zkSync Airbender / Boojum 0 / 0 Hexens (Airbender, 2025); none found for Boojum
Scroll 0 in scroll-tech/scroll Trail of Bits (Euclid, 2025)

RISC Zero

RISC Zero has published six advisories.

CVE-2025-52484 (critical, 18 June 2025)

  • A missing constraint in the rv32im circuit affected every three-register instruction in risc0-zkvm 2.0.0–2.0.2. It let a malicious prover treat rs1 as rs2.
  • It was reported through RISC Zero's HackenProof bounty and fixed in 2.1.0.

CVE-2025-54873 (medium, 4 August 2025)

  • Signed division admitted two outputs for some inputs, and division by zero was under-constrained.
  • It was found with Veridise's Picus tool and fixed in 2.2.0.

Response to both: RISC Zero disabled the affected on-chain verifiers through its "estop" mechanism. Contracts using the official verifier router needed no action.

CVE-2025-61588 (critical, 1 October 2025) is a different kind of bug: a guest-side memory-safety flaw. A host could answer sys_read with a crafted response, write to arbitrary guest memory, and so execute arbitrary code in the guest. Fixed versions are risc0-zkvm 2.3.2 and 3.0.3.

Earlier advisories:

  • GHSA-5c79-r6x7-3jx9 (high, 25 September 2024): an unconstrained "major mode" on multi-cycle instructions before 1.1.1. Official verifiers deprecated <1.1.1 receipts from 31 October 2024.
  • GHSA-349p-x622-29x6 (low): the host-supplied environment-variable and argument syscalls (sys_argc, sys_argv and the env-var call) are disabled by default from 1.1.3.
  • GHSA-5xgj-pmjj-gw49 (low): RISC Zero states that Haböck and Al Kindi's ePrint 2024/1037 shows its STARK did not provably meet zero knowledge.

Audits: The rz-security audit log lists Hexens zkVM and circuit audits (2023–2024) and a Veridise zkVM audit (June–December 2024). It also lists audits of precompiles, Steel, Kailua, Boundless and Groth16 verifiers by Veridise, Hexens and zkSecurity.

SP1 (Succinct)

SP1's six advisories span recursion, Fiat–Shamir and verifier input handling.

Recursion circuit

  • GHSA-f77q-r5qm-w4m8 (high): missing BabyBear range checks in the Gnark BN254 recursion circuit before 1.2.0. Succinct found it on 3 September 2024 and froze the v1.1.0 verifier on 4 September.

Fiat–Shamir transcript

  • GHSA-8m24-3cfx-9fjw (medium): the permutation argument's cumulative sum was not observed before sampling zeta. Fixed in 3.0.0.
  • GHSA-c873-wfhp-wx5m (high, 15 January 2025) covers three bugs, fixed in 4.0.0:
    • an unvalidated chip_ordering;
    • an under-constrained is_complete flag, found by Aligned, LambdaClass and 3MI Labs;
    • FRI evaluation claims not observed into the challenger, found by Lev Soukhanov and Onur Kilic.

Inherited Plonky3 bug and Zellic findings

  • GHSA-6248-228x-mmvh (high, 3 June 2025): SP1 inherited Plonky3's FRI flaw. The same advisory lists issues from a Zellic audit: a missing vk_root check in the Rust verifier, and an overflowing bounds check in the embedded allocator. Fixed in 5.0.0.

SP1 V6 (2026)

  • CVE-2026-40323 (high, 11 April 2026): the recursive jagged-PCS verifier did not bind committed row counts to the evaluation layout. Found through Code4rena; fixed in 6.1.0.
  • GHSA-p7v2-jjv3-8p8f (high, 11 October 2026): the native Rust verifier accepted tensors whose declared dimensions disagreed with their storage length.
    • Affected versions: 6.0.0–6.8.0; fixed in 6.8.1.
    • The only known affected deployment was Succinct's mainnet Prover Network.
    • Groth16 and Plonk paths were unaffected.
    • Found by Vitalis Salis through Immunefi.

Audits: The audits directory holds reports from Cantina, Code4rena, KALOS, rkm0959, Veridise and Zellic, including a Zellic "hypercube" report.

OpenVM

Before the 2026 batches

  • CVE-2025-46723 (high, 2 May 2025) came from a typo in the fix for a Cantina finding. Because enumerate() and skip(1) ran in the wrong order, the top pc limb in AUIPC was range-checked to 8 bits instead of 6. Fixed in 1.1.0.
  • GHSA-4w7p-8f9q-f4g2 records the shared Plonky3 FRI flaw.

15 May 2026 batch (all fixed in 1.6.0; credited to jonathanpwang):

  • GHSA-fh29-29h9-qm9h (critical): is_valid in PhantomAir was not constrained to be boolean, which breaks LogUp soundness. MemoryMerkleAir also lacked zero anchors.
  • GHSA-j9m2-fxc5-fr82 (critical): a permutation check in the recursion program was a no-op. It also covers missing NativePoseidon2Air constraints and a dependency on Plonky3's malleable MultiField32Challenger (GHSA-vj64-rjf3-w3v7).
  • GHSA-9jfx-4f4f-497j (high): the SHA-256 and Keccak AIRs had missing termination and state-change constraints.

26 June 2026 batch (all <1.7.0):

  • CVE-2026-62333 (critical): Merkle expansion rows were allowed at or below leaf height, letting a prover change the memory root.
  • CVE-2026-62334 (critical): the Solidity OpenVmHalo2Verifier self-call could dispatch to another selector. Verification then succeeded without checking the proof.
  • CVE-2026-62335 (medium): non-canonical app commitments were accepted.

Audits:

  • The v1 audits are Cantina reports for v1.0 to v1.5.0, plus a Nethermind formal-verification report on rv32im.
  • zkSecurity's OpenVM 2.0 audit began on 27 March 2026 and ran in four phases. It lists four high-severity findings, all in the deferral and continuation-aggregation code.

Jolt

Primaries are thin. The Jolt advisories page shows no published advisories. The README says Jolt "is in alpha and is not suitable for production use" and that the code "has not been audited." Reports go to jolt@a16z.com (SECURITY.md).

zkSync Airbender and Boojum

Primaries are thin. Neither Airbender nor Boojum has published advisories.

The Airbender repository contains a Hexens review:

  • It covered commit a10cb1d and ran from 12 August 2025 to a final report on 14 October 2025.
  • It reports one informational finding and nothing higher.

No Boojum audit report was found in the repository. Its README says only that zkSync Era "has been through lots of testing and audits" (README).

Scroll

scroll-tech/scroll shows no advisories. Trail of Bits' Euclid reviews describe Scroll's chunk, batch and bundle circuits as OpenVM guest programs.

  • Phase 1 (24 February – 5 March 2025): two high-severity soundness issues, TOB-SCREUC-1 and TOB-SCREUC-2. Through these, a malicious prover could bypass verification of inner chunk and batch proofs. In TOB-SCREUC-1, the aggregation circuit did not enforce proof lengths.
  • Phase 2 (6–21 March 2025): no soundness or completeness issues in the changed circuits.

Bug classes the disclosures actually show

  1. Under-constrained AIR columns. Examples are missing boolean checks, range checks, terminal-row anchors and leaf-height bounds. This is the most common class: RISC Zero 2025, OpenVM 2025–2026, SP1 recursion.
  2. Fiat–Shamir omissions. Values were not observed before challenges were sampled: SP1 v3 and v4, Plonky3 MultiField32Challenger.
  3. Verifier input-shape and encoding checks. These sit outside the circuit: Plonky3 and SP1 Rust verifiers, SP1 V6 tensors, OpenVM non-canonical commitments.
  4. Recursion and aggregation binding gaps. Examples are SP1 V6 row counts, the OpenVM permutation no-op, the zkSecurity deferral findings and the Scroll aggregation proof lengths.
  5. Guest runtime and host trust. Examples are RISC Zero sys_read and host syscalls, and SP1's embedded allocator.
  6. Shared upstream dependencies. One Plonky3 advisory produced separate advisories in both SP1 and OpenVM.

Two operational responses recur. RISC Zero uses router-level estop. SP1 freezes verifiers for vulnerable versions.

Timeline

  • 2024-07-15: RISC Zero zero-knowledge-property advisory.
  • 2024-09-04: SP1 v1.1.0 verifier frozen.
  • 2025-01-15: SP1 v4.0.0 advisory.
  • 2025-02-24 – 2025-03-21: Trail of Bits Euclid reviews.
  • 2025-05-02: OpenVM CVE-2025-46723.
  • 2025-06-03: Plonky3 FRI advisory; SP1 and OpenVM follow-ons.
  • 2025-06-18 / 08-04 / 10-01: RISC Zero CVE-2025-52484, -54873, -61588.
  • 2025-10-14: Hexens Airbender final report.
  • 2026-04-11: SP1 CVE-2026-40323.
  • 2026-05-15: OpenVM 1.6.0 batch, including CVE-2026-46669.
  • 2026-06-26: OpenVM CVE-2026-62333/4/5.
  • 2026-10-11: SP1 V6 tensor advisory (6.8.1).

Sources

Related guides: under-constrained circuits, auditing circom, choosing a proving system, trusted setup risk, the checklist.