CVE-2026-52735 ZcashFoundation CVE debrief

Who should care

Defenders and operators of ZEBRA nodes should be aware of this vulnerability and take action to upgrade to version 4.5.0 or later to prevent potential consensus chain splits. They should also monitor for any unusual network activity that could indicate exploitation. Additionally, security teams and vulnerability management teams should review the vulnerability and assess the impact on their systems.

Why it matters

Defenders should prioritize upgrading to ZEBRA version 4.5.0 or later to prevent potential consensus chain splits. The vulnerability causes incorrect counting of signature operations in P2SH scripts, leading to possible network instability.

• Potential consensus chain split affecting network integrity and availability
• Incorrect counting of signature operations in P2SH scripts
• Possible network instability due to inconsistent block validation

Technical summary

The vulnerability in ZEBRA versions prior to 4.5.0 causes incorrect counting of signature operations in P2SH scripts, leading to potential consensus chain splits. The issue arises from the use of the pure-Rust script::Code::sig_op_count path, which stops counting at disabled opcodes, whereas zcashd continues counting through them. This can lead to incorrect counting of signature operations, causing ZEBRA to accept blocks that zcashd rejects. The vulnerability is fixed in version 4.5.0. Defenders should prioritize upgrading to ZEBRA version 4.5.0 or later to prevent potential consensus chain splits. The incorrect counting of signature operations can lead to possible network instability due to inconsistent block

Defensive priority

Defenders should prioritize upgrading to ZEBRA version 4.5.0 or later to prevent potential consensus chain splits. They should also monitor for any unusual network activity that could indicate exploitation.

Recommended defensive actions

• Upgrade to ZEBRA version 4.5.0 or later
• Monitor network activity for unusual behavior
• Verify P2SH script counting in ZEBRA configurations
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by incorrect counting of signature operations in P2SH scripts in ZEBRA versions prior to 4.5.0. The issue arises from the use of the pure-Rust script::Code::sig_op_count path, which stops counting at disabled opcodes, whereas zcashd continues counting through them.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.