OpenVM: Memory Merkle root manipulation in MemoryMerkleAir
Summary
OpenVM's MemoryMerkleAir does not reject Merkle expansion rows at or below the memory leaf height. A malicious prover can fabricate a subtree below a memory leaf and swap digests inside it, changing the committed memory root without a corresponding memory operation. This affects the soundness of OpenVM proofs that use persistent memory across continuation segments, and the attacker must control proof generation.
Affected
- OpenVM before 1.7.0 (1.x line)
- OpenVM 2.0.0-alpha up to, but excluding, 2.0.0-rc.3
- OpenVM 2.1.0-dev.0 up to, but excluding, 2.1.0-preview
Fixed in
- 1.7.0
- 2.0.0-rc.3
- 2.1.0-preview
Workaround
Unknown. No vendor-documented workaround found; upgrading is the only remedy in the sources.
Exploitation
No evidence of exploitation in the wild found. No public exploit found; VulDB states that no exploit is available (VulDB assessment, not a vendor statement).
Our recommendation
- Check whether any OpenVM-based component is in use, including through third-party zk or blockchain tooling.
- Upgrade to 1.7.0, 2.0.0-rc.3, 2.1.0-preview or later.
- Ask vendors or developers whether they rely on OpenVM persistent-memory proofs.
- Note the severity gap: CNA rates 8.7 (High), VulDB 5.4 (Medium). Use the vendor rating for prioritisation.
- Exposure is likely low for most SMEs, since OpenVM is a developer framework.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-396x-v8w4-9x82 github.com
- OpenVM release v1.7.0 github.com
- OpenVM release v2.0.0-rc.3 github.com
- OpenVM release v2.1.0-preview github.com
- Fix pull request #148 github.com
- Fix commit bb123f6 github.com
- air.rs at v2.0.0-alpha github.com
- VulDB entry 429361 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 23:17.
Original description (NVD)
OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, `MemoryMerkleAir` does not forbid Merkle expansion rows at `parent_height` = 0 or below while `expand_direction` != 0. A malicious prover can fabricate a subtree below a memory leaf and swap digests inside that subtree to change the committed memory root without a corresponding memory operation. The fraudulent rows still balance against the Merkle and compression buses and require no memory-bus operation for the changed leaf. Because the memory Merkle root binds VM memory state across continuation segment boundaries, this affects the soundness of OpenVM proofs using persistent memory. This issue is fixed in versions 1.7.0, 2.0.0-rc.3 and 2.1.0-preview.
NVD references (9)
- https://github.com/openvm-org/openvm/blob/v2.0.0-alpha/crates/vm/src/system/memory/merkle/air.rs
- https://github.com/openvm-org/openvm/blob/v2.0.0-beta.2/crates/vm/src/system/memory/merkle/air.rs
- https://github.com/openvm-org/openvm/blob/v2.1.0-dev.0/crates/vm/src/system/memory/merkle/air.rs
- https://github.com/openvm-org/openvm/commit/bb123f6073691bd2b794171c594264c77e45c376
- https://github.com/openvm-org/openvm/pull/148
- https://github.com/openvm-org/openvm/releases/tag/v1.7.0
- https://github.com/openvm-org/openvm/releases/tag/v2.0.0-rc.3
- https://github.com/openvm-org/openvm/releases/tag/v2.1.0-preview
- https://github.com/openvm-org/openvm/security/advisories/GHSA-396x-v8w4-9x82
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.