The flaw is a soundness vulnerability in the SP1 V6 recursive shard verifier that permits a malicious prover to construct a recursive proof from a shard proof that the native verifier would normally reject. Because the verifier accepts these forged proofs, an attacker can convince downstream systems that a desired state or computation has been correctly executed, leading to potential data integrity breach or unauthorized access to protected resources. The weakness is categorized as CWE-345 (Wrong Order of Operations) and CWE-354 (Missing Invariant in a Recursive Algorithm).

The affected product is the SP1 virtual machine from succinctlabs. Versions 6.0.0 through 6.0.2 contain the flaw, while version 6.1.0 contains the fix. No other vendors or products are listed as impacted.

The CVSS score of 8.9 indicates a high severity; the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a malicious prover who can send crafted proofs to the SP1 verifier, which may occur in environments that accept third‑party proof submissions, such as zk‑based consensus systems or trusted execution contexts. Exploitation requires the ability to supply proof files to the verifier; once the forged proof is accepted, the attacker may compromise the integrity of the system relying on the verifier's output.