CVE Catalog
CVE-2026-35679
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk0.22%
13th percentile - higher than 13% of all known CVEs
Summary
In Zcash zcashd before version 6.12.0, invalid transactions could be accepted under certain conditions because Sprout proofs were sometimes not verified. This could lead to draining of user funds from the Sprout pool.
Risk Assessment
An attacker could potentially drain user funds from the Sprout pool by accepting invalid transactions, leading to financial loss.
Recommendation
Immediately update Zcash zcashd to version 6.12.0 or later, which contains the fix.
Original NVD description (English source)
Zcash zcashd before 6.12.0 allows invalid transactions to be accepted under certain conditions, which potentially could have resulted in the draining of user funds from the Sprout pool. It was sometimes not verifying Sprout proofs.