Cyber Posture

CVE-2026-41584

High

Published: 08 May 2026

Published
08 May 2026
Modified
08 May 2026
KEV Added
—
Patch
—
CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0004 12.8th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-41584 is a high-severity Reachable Assertion (CWE-617) vulnerability in Zfnd Zebra-Chain. Its CVSS base score is 7.5 (High).

Operationally, ranked at the 12.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

NVD Description

ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.1 and prior to zebra-chain version 6.0.2, Orchard transactions contain a rk field which is a randomized validating key and also an elliptic curve point. The Zcash…

more

specification allows the field to be the identity (a "zero" value), however, the orchard crate which is used to verify Orchard proofs would panic when fed a rk with the identity value. Thus an attacker could send a crafted transaction that would make a Zebra node crash. This issue has been patched in zebrad version 4.3.1 and zebra-chain version 6.0.2.

Deeper analysisAI

Automated synthesis unavailable for this CVE.

Details

CWE(s)
CWE-617

Affected Products

zfnd
zebra-chain
≤ 6.0.2
zfnd
zebrad
≤ 4.3.1

CVEs Like This One

CVE-2026-44498Same product: Zfnd Zebrad
CVE-2026-40881Same product: Zfnd Zebrad
CVE-2026-34202Same product: Zfnd Zebra-Chain
CVE-2026-41583Same product: Zfnd Zebrad
CVE-2026-40880Same product: Zfnd Zebrad
CVE-2026-44497Same product: Zfnd Zebrad
CVE-2026-34377Same vendor: Zfnd
CVE-2025-15530Shared CWE-617
CVE-2026-22990Shared CWE-617
CVE-2026-31739Shared CWE-617

References