SZB-087fa10ed3
EUVD lists snark-verifier KZG limb bounds flaw (EUVD-2026-114397)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Axiom
- Product
- snark-verifier
- First seen
Summary
The EUVD entry, as relayed on Mastodon, says that before 0.2.5, snark-verifier decoded KZG accumulator public-instance limbs without consistently enforcing canonical bounds. It gives a CVSS v3.1 score of 6.9/10; the visible text is truncated, so the exploit conditions are not stated here.
If you use Axiom
Upgrade snark-verifier to 0.2.5 or later
Check whether verifier code paths accept externally supplied proofs
What the sources say 1
· Mastodon: “Prior to 0.2.5, KZG accumulator public-instance limbs are decoded without consistently enforcing canonical limb bounds before elliptic-curve coordinate reconstruction.” Source