CVE-2026-46654: Plonky3 MultiField32Challenger: transcript malleability and challenge entropy loss

Synopsis

This is a cryptographic protocol vulnerability (transcript malleability) in the Plonky3 zero-knowledge proof toolkit, specifically in its MultiField32Challenger component. An attacker who controls prover-side observations can craft two distinct transcripts that produce identical Fiat-Shamir challenges, breaking the binding property that the protocol relies on for soundness. Successful exploitation allows an attacker to produce fraudulent proofs that pass verification, enabling integrity violations in any system that relies on Plonky3 for proof generation and verification. The CVE description notes patches exist at versions 0.4.3 and 0.5.3; a patched-image rebuild at those versions is available on HarborGuard for environments running affected versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the proof-generation or verification service over the network to submit crafted prover-side observations.

• AuthenticationNot required

  No credentials are needed; the attack can be attempted by any party able to submit inputs to the prover.

• Victim interactionNot required

  No user action is required; the attacker interacts directly with the affected service.

• Attack complexityDetail

  Attack complexity is rated High, meaning the attacker must carefully craft transcripts that satisfy the collision condition, requiring non-trivial cryptographic computation and precise control over observation inputs.

Blast Radius

• An attacker forges proof transcripts that are accepted as valid by the verifier, bypassing soundness guarantees entirely.
• Persisted state or on-chain records that depend on proof validity can be written with fraudulent data, corrupting the integrity of the system.
• Any downstream logic gated on proof acceptance (asset transfers, state transitions, authorization checks) executes based on false premises.
• Systems that embed Plonky3 in a larger protocol stack expose that entire stack to integrity compromise through a single malformed proof submission.