How severe is CVE-2026-52738?

No CVSS score has been assigned to CVE-2026-52738 yet. Review the advisory details and affected package list to assess your exposure.

Which packages are affected by CVE-2026-52738?

CVE-2026-52738 affects the following packages: zebra-state (crates.io), zebrad (crates.io). Ecosystems affected: crates.io.

How do I fix CVE-2026-52738?

Update zebra-state to 7.0.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-52738 is resolved across your whole dependency graph.

How do I detect CVE-2026-52738 in my crates.io dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for zebra-state, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate CVE-2026-52738 if there is no patch (or I can't update yet)?

Stop feeding it untrusted input: reject or quarantine files and payloads from unverified sources until you can upgrade, restrict accepted formats to the ones you actually need, and run the parsing or decoding step in a least-privileged sandbox or short-lived worker so a crash or corrupted read cannot reach the rest of the process.

Is CVE-2026-52738 actively exploited in the wild?

No public exploit code has been indexed for CVE-2026-52738 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

What is the EPSS score for CVE-2026-52738?

CVE-2026-52738 has an EPSS (Exploit Prediction Scoring System) score of 0.5%, placing it in the 41th percentile of all CVEs. EPSS is maintained by FIRST.org and estimates the probability that a vulnerability will be exploited in the wild within the next 30 days. This score indicates relatively lower exploitation probability, though the CVSS severity should still guide your patching priority.

What type of vulnerability is CVE-2026-52738?

CVE-2026-52738 is classified as CWE-248 (CWE-248). This weakness type describe the underlying flaw category, which helps determine the potential impact and the right class of mitigation.

When was CVE-2026-52738 published, and has it been updated?

CVE-2026-52738 was published on August 18, 2026 and was last updated on September 11, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

🦀 crates.io

Not in CISA KEV

CVE-2026-52738 — zebra-state

Fix: ZcashFoundation/zebra@1440b43

CVE-2026-52738 is a CWE-248 vulnerability in zebra-state. A fix is available for zebra-state — see the affected versions and patch details below.

ZEBRA: Finalized address balance credit-first overflow on consensus-valid blocks

Also known asGHSA-w834-cf6p-9m9w

Published

Aug 18, 2026

Updated

Sep 11, 2026

Affected

2 pkgs

Patched

2 / 2

Exploits

None indexed

Exploitation data as of Sep 28, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

EPSS Exploitation Probability

via FIRST.org ↗

0.5%probability of exploitation in next 30 days

Lower Risk0.00%

Lower risk than most CVEs41th percentile — riskier than 41% of all scored CVEsHighest risk

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

Real-World Exposure

2 pkgs affected

🦀zebra-state🦀zebrad

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects crates.io packages — download data is not available via public APIs for these ecosystems.

Description

Am I affected

You are affected if:

You run zebrad up to and including v4.4.1.
Your node processes blocks on any Zcash network.

Summary

The finalized transparent address balance writer processes all newly-created outputs (credits) before processing spent outputs (debits) within the same block. A consensus-valid block containing a long chain of same-address transparent self-spends can cause the intermediate per-address balance during the credit pass to exceed MAX_MONEY, triggering a panic in the finalized state writer.

Because the triggering block is consensus-valid (zcashd accepts it), the panic recurs on restart when the node re-encounters the same block. This creates a persistent chain halt that can only be resolved by a software patch.

Details

The finalized state writer at zebra-state/src/service/finalized_state/zebra_db/transparent.rs iterates all transaction outputs in a block and credits them to per-address balances before iterating inputs and debiting spent outputs. When a block contains many transparent self-spends to the same address, the intermediate credit-only balance can exceed the MAX_MONEY supply cap even though the final net balance (credits minus debits) is valid.

The code panics on the intermediate overflow via .expect() on the balance addition. Under Zebra's panic = "abort" release profile, this terminates the process. On restart, the node re-downloads and re-processes the same consensus-valid block, triggering the same panic.

An attacker with approximately 1,100–2,100 ZEC and mining capability can construct a block that permanently halts all Zebra nodes. The attacker recovers their capital (the self-spends return funds to the same address), so the net cost is the mining effort only.

Patches

Patched in Zebra 4.4.2. The fix processes credits and debits together per transaction rather than all credits then all debits, matching zcashd's approach.

Workarounds

No workaround is available. Upgrade to Zebra 4.4.2.

Impact

A single consensus-valid mined block can permanently halt all Zebra nodes on the network. The halt persists across restarts. Recovery requires deploying a patched version. Downstream consumers (light wallets, exchanges, mining infrastructure) lose service for the duration of the halt.

Credit

Reported by @sangsoo-osec.

Affected Packages

2 total 2 fixed

Ecosystem	Package	Vulnerable range	Fix
🦀crates.io	`zebra-state`	all versions	7.0.0`cargo update -p zebra-state --precise 7.0.0`
🦀crates.io	`zebrad`	all versions	4.5.0`cargo update -p zebrad --precise 4.5.0`

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for zebra-state, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update zebra-state to 7.0.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-52738 is resolved across your whole dependency graph.
Workarounds
Stop feeding it untrusted input: reject or quarantine files and payloads from unverified sources until you can upgrade, restrict accepted formats to the ones you actually need, and run the parsing or decoding step in a least-privileged sandbox or short-lived worker so a crash or corrupted read cannot reach the rest of the process.

Frequently Asked Questions

### Am I affected You are affected if: 1. You run `zebrad` up to and including `v4.4.1`. 2. Your node processes blocks on any Zcash network. ### Summary The finalized transparent address balance writer processes all newly-created outputs (credits) before processing spent outputs (debits) within the same block. A consensus-valid block containing a long chain of same-address transparent self-spends can cause the intermediate per-address balance during the credit pass to exceed `MAX_MONEY`, triggering a panic in the finalized state writer. Because the triggering block is consensus-valid (zca

O3 Security · Impact-Aware SCA

Is CVE-2026-52738 in your dependencies?

Find it across crates.io, including transitive dependencies.

Scan my dependencies How O3 SCA works