CVE-2026-46669
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedOpenVM is a performant and modular zkVM framework built for customization and extensibility. Prior to version 1.6.0, the openvm-pairing guest library's try_honest_pairing_check function invokes Theorem 3 of https://eprint.iacr.org/2024/640.pdf but does not check that the scaling factor s is in a proper subfield of Fp12. This allows incorrect results to the pairing check. This issue has been patched in version 1.6.0.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceThe openvm-pairing guest library's try_honest_pairing_check function fails to validate that the scaling factor s is in the proper subfield of Fp12 when implementing Theorem 3 from the referenced paper. This missing validation allows incorrect pairing check results, potentially compromising zero-knowledge proofs that depend on this verification.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data< 1.6.0CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- High
- Availability
- None
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify installed openvm-pairing versionRun package manager query or check library binary version (e.g., pip show openvm-pairing, cargo tree for openvm-pairing, or check /usr/lib/libopenvm-pairing version)Affected if Version is below 1.6.0
-
Locate application dependenciesReview project dependency manifest (requirements.txt, Cargo.toml, package.json, or similar) to confirm openvm-pairing is listedAffected if openvm-pairing dependency version is less than 1.6.0 or unpinned
-
Check for try_honest_pairing_check usageSearch codebase for calls to try_honest_pairing_check function or pairing verification logic (grep -r 'try_honest_pairing_check' or similar)Affected if Codebase uses pairing check functionality from openvm-pairing library
-
Inspect cryptographic zkVM workflowsReview application logic that performs zkVM computations requiring pairing-based verificationAffected if Application performs zkVM computations that rely on openvm-pairing for cryptographic verification
User is affected if openvm-pairing version is below 1.6.0 AND the application uses pairing check functionality in zkVM computations.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scoped1.6.0
Upgrade openvm-pairing to version 1.6.0 or later, which adds the required subfield validation for the scaling factor s.
1.6.0
- 1. Identify the current version of OpenVM or openvm-pairing library in your project by checking your dependency manifest (e.g., Cargo.toml, package.json, or equivalent)
- 2. Update the openvm or openvm-pairing dependency to version 1.6.0 or later
- 3. Run your project's test suite to verify the upgrade does not break existing functionality
- 4. Rebuild and redeploy any services or applications that depend on the openvm-pairing guest library
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation2.0 h
- Implementation4.0 h
- Testing6.0 h
- Review / QA3.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $4,096.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2026-46669 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2026-46669 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data