VulnerabilityDeferred

CVE-2026-35679

Zcash zcashd before 6.12.0 allows invalid transactions to be accepted under certain conditions, which potentially could have resulted in the draining of user funds from the Sprout pool.

LOW 3.5EPSS 0.22%

Does this matter?

Lower severity and a low EPSS score (0.22%). Track it; it rarely justifies an emergency change on its own.

Description

Zcash zcashd before 6.12.0 allows invalid transactions to be accepted under certain conditions, which potentially could have resulted in the draining of user funds from the Sprout pool. It was sometimes not verifying Sprout proofs.

CVSS 3.1: 3.5 LOWCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N
EPSS: 0.22% probability · 13th percentile
CISA KEV: Not listed
Weakness: CWE-358
Source: cve@mitre.org

References

https://github.com/zcash/zcash/commit/db969c63f48f0f9fc518112ed0b7ace1af78b9d0
https://github.com/zcash/zcash/releases/tag/v6.12.0

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.