This vulnerability allows Zcash zcashd to accept invalid transactions under certain conditions, potentially causing unauthorized transfer of user funds from the Sprout pool because the node sometimes fails to verify Sprout proofs. The weakness, identified as CWE‑358, results in an integrity breach that could allow an attacker to drain funds that should have been protected by cryptographic validation.

The issue affects the Zcash daemon (zcashd) in all releases prior to version 6.12.0. Any node using those earlier builds without the patch may be vulnerable, regardless of operating system or deployment environment.

The CVSS score of 3.5 indicates low severity, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited widespread exploitation. However, the attack vector is inferred to be remote: a threat actor could craft a malicious transaction and broadcast it to a vulnerable node, leveraging the lack of proof verification to create phantom balances. Since no EPSS score is available, the exact exploitation probability is uncertain, but the potential financial impact warrants remediation.