Zebra, a Zcash node implemented in Rust, stored Sapling and Orchard subtree roots in a local on‑disk database. The pop_tip routine removed a reverted block from the chain but failed to delete subtree entries whose end height belonged to the removed block, a flaw corresponding to CWE‑459 (Improper Release of Resource) and CWE‑672 (Data or State Manipulation). When a natural or attacker‑influenced fork later finalizes, these stale subtree roots can be written to RocksDB and survive node restarts. Clients that request subtree roots, such as lightwalletd and light wallets, receive incorrect values, causing wallet synchronization failures, corrupted state, and requiring a full state rebuild for recovery.

The issue exists in all releases of ZcashFoundation Zebra and zebra‑state prior to version 4.5.0. The 4.5.0 release and newer contain a fix that corrects the pop_tip cleanup logic and removes stale subtree entries. Only deployments running pre‑4.5.0 builds are vulnerable.

The CVSS score of 6.5 signals moderate‑to‑high severity. No EPSS score is available, and the vulnerability is not listed in CISA KEV. The attack vector is an induced or natural chain reorg: an attacker could broadcast conflicting blocks to trigger a fork, or a network reorg could occur spontaneously. Once the stale data is persisted, an affected node can unintentionally deliver corrupted subtree roots to light clients, leading to integrity violations and availability disruption.