Low 3.5Published Apr 5, 2026

CVE-2026-35679Zcash zcashd before 6.12.0 allows invalid transactions to be accepted under certain conditions, which potentially could have resulted in the draining of user funds from the Sprout pool.

Updated under an hour ago (2026-10-19 08:00 UTC)

Does this affect you?

It lists no affected products yet. Add what you run and Signals checks it as products are added.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Exploited in the last 30 days

Zcash zcashd before 6.12.0 allows invalid transactions to be accepted under certain conditions, which potentially could have resulted in the draining of user funds from the Sprout pool. It was sometimes not verifying Sprout proofs.

CVSS: 3.5 LOW (v3.1, NVD)CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N
Weakness (CWE): CWE-358
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Not given
NVD analysis: Deferred
Record last updated: Jul 24, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

No affected products are listed yet.

References

https://github.com/zcash/zcash/commit/db969c63f48f0f9fc518112ed0b7ace1af78b9d0
https://github.com/zcash/zcash/releases/tag/v6.12.0

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.