The vulnerability arises from a missing copy constraint in the variable‑base scalar multiplication gadget of halo2_gadgets, allowing an attacker to use an under‑constrained base point. This flaw permits a malicious prover to generate a valid proof for an Orchard Action that bypasses the diversified‑address‑integrity check normally binding the recipient’s public key, group element, incoming viewing key, nullifier, and spend validation key to the note being spent. The effect is the ability to forge spend proofs and undermine the soundness of the Orchard protocol, which can lead to unauthorized transfer of funds.

Vulnerable versions include the ZcashFoundation Zebra node prior to 5.0.0, halo2_gadgets before 0.5.0, orchard before 0.14.0, zcash_primitives before 0.28.0, and zcashd before 6.20.0. All components are part of the official Zcash software stack, so any user running these releases is affected.

The CVSS v3 score of 9.3 indicates very high severity, while the EPSS score of <1% reflects a low but nonzero probability of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is inferred to be a custom prover constructing an Orchard transaction proof with an under‑constrained base point; it is unclear whether this requires local execution or can be performed remotely, but any basis to submit such proofs to the network could lead to fraud. No public exploit has been reported, but the risk of unauthorized fund transfer exists if an attacker succeeds.