The vulnerability arises from a logic error in Zebra’s state writer, where it records credit for each new transparent output before debiting spent outputs within the same block. This credit-first ordering can temporarily raise an address’s balance beyond the maximum allowed value during block processing, leading to an abort-triggered panic in a release build. Consequently, the node terminates and remains stalled on every restart until a patched version is deployed.

Affected deployments are Zcash Foundation’s Zebra full node and zebra-state components running any release prior to version 4.5.0. All nodes that validate consensus blocks and maintain the transparent address balance will be subject to this crash when presented with a specially crafted block containing a long chain of self-spends to a single address.

The CVSS score of 6.9 indicates moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no public exploitation yet. However, the precise attack requires an adversary to mine or otherwise inject a consensus‑valid block that performs many consecutive transparent self-spends to a single address, a capability that is limited to participants with block‑mining power or the ability to subvert a mining rig. Once such a block is propagated to any vulnerable node, the node will panic and remain halted until upgraded, effectively denying service to that node and potentially disrupting its participation in the network. The likely attack vector is the network interface that receives new blocks, which is typically exposed to public peers; the description implies an intentional block creation rather than a passive request chain.