PT-2026-30508 · Zcash · Zcash

Daira-Emma Hopwood · Published 2026-04-05 · Updated 2026-05-19 · CVE-2026-35679

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Zcash versions prior to 6.12.0

Description Zcash zcashd versions prior to 6.12.0 were susceptible to accepting invalid transactions under specific circumstances. This could have potentially led to the loss of user funds from the Sprout pool due to insufficient verification of Sprout proofs.

Recommendations Update to version 6.12.0 or later.

Fix

Improperly Implemented Security Check for Standard

Weakness Enumeration

CWE-358

Related Identifiers

CVE-2026-35679

Affected Products

Zcash

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-35679 · Security Note
• https://github.com/zcash/zcash/releases/tag/v6.12.0 · Note
• https://github.com/zcash/zcash/commit/db969c63f48f0f9fc518112ed0b7ace1af78b9d0 · Note
• https://t.me/cveNotify/164070 · Telegram Post
• https://twitter.com/infoflowcloud/status/2040912566021505034 · Twitter Post
• https://twitter.com/CVEnew/status/2040911762187223292 · Twitter Post